Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXE1142913f87f43537066597caf5d9b921XWorm
Structure
Config. Field Value
Mutex YFVimjhuhuhuhuhuhuhuhuhuhuhu
KEY AlM5l4huhuhuhuhuhuhuhuhuhuhu
USBNM /kS6JQhuhuhuhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::00OHT6l6JUZ2sUBVADYgypgpxp5c6eV9inO6F1BJ30ku7XI4v1xpolbXulqiuWPMDMsVTXdHLwyXmSod17vbDdQ0dC4cLyy6()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
292
Main Method 
System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::00OHT6l6JUZ2sUBVADYgypgpxp5c6eV9inO6F1BJ30ku7XI4v1xpolbXulqiuWPMDMsVTXdHLwyXmSod17vbDdQ0dC4cLyy6()
Main IL Instruction Count
63
Main IL 
ldsfld System.Int32 A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::fZHaw9dxf4P0dqeEQG6rcUzXsDzz8z7CwktBwl9yv1nlhpi88xPNqxtxTa91AEN97LHVWp7plgnNZOPX4xyAqGAE09wghZan
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::krfzwzM1CZUzcD51bkjnOTuqKR7NiGYzhn1IjMDUzKBbjm9FB6hHL6BHkyO1Gw7lyd4NetQtfUWyFWuAF8XbvIpyjsIwcyIp
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::krfzwzM1CZUzcD51bkjnOTuqKR7NiGYzhn1IjMDUzKBbjm9FB6hHL6BHkyO1Gw7lyd4NetQtfUWyFWuAF8XbvIpyjsIwcyIp
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::5ASdYT5hOMMs8liYYLpzS1ttZMT3iu9iWpzepzd6Jt4TzN5q5VnGRIUl3pgrEhlGQ7r5R04BOsk2Ef2L2erMWqaqRlhrGAZq
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::5ASdYT5hOMMs8liYYLpzS1ttZMT3iu9iWpzepzd6Jt4TzN5q5VnGRIUl3pgrEhlGQ7r5R04BOsk2Ef2L2erMWqaqRlhrGAZq
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::OMEb2mi6sp2freX1VEPOqoMpBXgoBah0Wr2t7seQjNHcEtdekqUeGWpemyUmlUhnUcpsXlOl3g1QiEVRlJhC4gCt4sEG6Te9
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::OMEb2mi6sp2freX1VEPOqoMpBXgoBah0Wr2t7seQjNHcEtdekqUeGWpemyUmlUhnUcpsXlOl3g1QiEVRlJhC4gCt4sEG6Te9
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::IrBTVLdqAfvE7PHgNrpnKztkSYuWkRodVr8EYpxwiwibCAAr3EXXsH34M4qGzEh6YBB0IasiELRvNH9Apb5gCz26MPH318ZU
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::IrBTVLdqAfvE7PHgNrpnKztkSYuWkRodVr8EYpxwiwibCAAr3EXXsH34M4qGzEh6YBB0IasiELRvNH9Apb5gCz26MPH318ZU
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::W2yKQlnoqdye9XR14BDkeDRcPbGW6s0KGjBBOOpdRdkNhWBmm92yigghXmfqc0xhYLNNcCnWZwzrgtwFhMqhB4oNVCpZVgdM
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::W2yKQlnoqdye9XR14BDkeDRcPbGW6s0KGjBBOOpdRdkNhWBmm92yigghXmfqc0xhYLNNcCnWZwzrgtwFhMqhB4oNVCpZVgdM
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::LJ2VVNO73KAiRH9hpEfLlSblVHbesgGeTvLhYfGWPYNc5JlxGXsNbvkd8gYcur3nXklHdpyCejjdtiYYnAdaDhbVcN4I5Oaf
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::LJ2VVNO73KAiRH9hpEfLlSblVHbesgGeTvLhYfGWPYNc5JlxGXsNbvkd8gYcur3nXklHdpyCejjdtiYYnAdaDhbVcN4I5Oaf
leave.s IL_009E: call System.Boolean Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::A9b2lfJdIIYeNBAHLcgxstoV7NJByKFfozmzdE()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::A9b2lfJdIIYeNBAHLcgxstoV7NJByKFfozmzdE()
call System.Boolean Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::A9b2lfJdIIYeNBAHLcgxstoV7NJByKFfozmzdE()
brtrue.s IL_00AB: call System.Void Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::AAND46F1GKhsZQU32fIFWKi1aCScDqPhn1olg5()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::AAND46F1GKhsZQU32fIFWKi1aCScDqPhn1olg5()
ldnull <null>
ldftn System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::tQnzpHXIkx6tDiTGXsRHw3X5PeDjK3hJndZoDAlyzboiyEQoP3u5JF4Pc9In5Md2hLGWb5xkBZHtSyDdGwRQqc7bYxbopFuq()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::NVxg2IzXM5jWdwkrmWYlaF8CknKA60busfzleNl5VXpcF6uHxPG8VZMdRSv88tN4xWqJtoN6g3IfRUEz2Nu07brEsHsnkAD4()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::FmSNfqClsUe9CQWQJZoYwGmi9KTjWxC0rGuMFqov0WPacWbP6Yvj06jWkYVgxYf80HqEWmHWgO4HyHIudZiN5YuX15sCGlRv()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::00OHT6l6JUZ2sUBVADYgypgpxp5c6eV9inO6F1BJ30ku7XI4v1xpolbXulqiuWPMDMsVTXdHLwyXmSod17vbDdQ0dC4cLyy6()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
292
Main Method 
System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::00OHT6l6JUZ2sUBVADYgypgpxp5c6eV9inO6F1BJ30ku7XI4v1xpolbXulqiuWPMDMsVTXdHLwyXmSod17vbDdQ0dC4cLyy6()
Main IL Instruction Count
63
Main IL 
ldsfld System.Int32 A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::fZHaw9dxf4P0dqeEQG6rcUzXsDzz8z7CwktBwl9yv1nlhpi88xPNqxtxTa91AEN97LHVWp7plgnNZOPX4xyAqGAE09wghZan
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::krfzwzM1CZUzcD51bkjnOTuqKR7NiGYzhn1IjMDUzKBbjm9FB6hHL6BHkyO1Gw7lyd4NetQtfUWyFWuAF8XbvIpyjsIwcyIp
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::krfzwzM1CZUzcD51bkjnOTuqKR7NiGYzhn1IjMDUzKBbjm9FB6hHL6BHkyO1Gw7lyd4NetQtfUWyFWuAF8XbvIpyjsIwcyIp
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::5ASdYT5hOMMs8liYYLpzS1ttZMT3iu9iWpzepzd6Jt4TzN5q5VnGRIUl3pgrEhlGQ7r5R04BOsk2Ef2L2erMWqaqRlhrGAZq
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::5ASdYT5hOMMs8liYYLpzS1ttZMT3iu9iWpzepzd6Jt4TzN5q5VnGRIUl3pgrEhlGQ7r5R04BOsk2Ef2L2erMWqaqRlhrGAZq
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::OMEb2mi6sp2freX1VEPOqoMpBXgoBah0Wr2t7seQjNHcEtdekqUeGWpemyUmlUhnUcpsXlOl3g1QiEVRlJhC4gCt4sEG6Te9
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::OMEb2mi6sp2freX1VEPOqoMpBXgoBah0Wr2t7seQjNHcEtdekqUeGWpemyUmlUhnUcpsXlOl3g1QiEVRlJhC4gCt4sEG6Te9
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::IrBTVLdqAfvE7PHgNrpnKztkSYuWkRodVr8EYpxwiwibCAAr3EXXsH34M4qGzEh6YBB0IasiELRvNH9Apb5gCz26MPH318ZU
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::IrBTVLdqAfvE7PHgNrpnKztkSYuWkRodVr8EYpxwiwibCAAr3EXXsH34M4qGzEh6YBB0IasiELRvNH9Apb5gCz26MPH318ZU
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::W2yKQlnoqdye9XR14BDkeDRcPbGW6s0KGjBBOOpdRdkNhWBmm92yigghXmfqc0xhYLNNcCnWZwzrgtwFhMqhB4oNVCpZVgdM
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::W2yKQlnoqdye9XR14BDkeDRcPbGW6s0KGjBBOOpdRdkNhWBmm92yigghXmfqc0xhYLNNcCnWZwzrgtwFhMqhB4oNVCpZVgdM
ldsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::LJ2VVNO73KAiRH9hpEfLlSblVHbesgGeTvLhYfGWPYNc5JlxGXsNbvkd8gYcur3nXklHdpyCejjdtiYYnAdaDhbVcN4I5Oaf
call System.Object Stub.6LfvyXIzMUAn61cirrXTMJorlCxDiB9KIOOgNg::RRBV9uE46msojmT6KRNy96utW7e1rvMzucf1p9(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String A2UqIOj3an2BQeseHbWCUtauMM6bJ8n5hahVmR09N2t2tUk97H2poYPcuFxBUSbawy8tZ2chSRjeQWJGnYduxwoIJGd8pwXr::LJ2VVNO73KAiRH9hpEfLlSblVHbesgGeTvLhYfGWPYNc5JlxGXsNbvkd8gYcur3nXklHdpyCejjdtiYYnAdaDhbVcN4I5Oaf
leave.s IL_009E: call System.Boolean Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::A9b2lfJdIIYeNBAHLcgxstoV7NJByKFfozmzdE()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::A9b2lfJdIIYeNBAHLcgxstoV7NJByKFfozmzdE()
call System.Boolean Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::A9b2lfJdIIYeNBAHLcgxstoV7NJByKFfozmzdE()
brtrue.s IL_00AB: call System.Void Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::AAND46F1GKhsZQU32fIFWKi1aCScDqPhn1olg5()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.9NImiG8vU1jVZY5efmuV4PZnQKdaeRyCZ0wT6h::AAND46F1GKhsZQU32fIFWKi1aCScDqPhn1olg5()
ldnull <null>
ldftn System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::tQnzpHXIkx6tDiTGXsRHw3X5PeDjK3hJndZoDAlyzboiyEQoP3u5JF4Pc9In5Md2hLGWb5xkBZHtSyDdGwRQqc7bYxbopFuq()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::NVxg2IzXM5jWdwkrmWYlaF8CknKA60busfzleNl5VXpcF6uHxPG8VZMdRSv88tN4xWqJtoN6g3IfRUEz2Nu07brEsHsnkAD4()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.4sOdXZ0GErfu58qAeMUAbWbJ4xWhsSolV3X4V64KWBQpjDNlqdNzxp7bqJ9iOGEaYR97PhjbSMFg5ZllwlQIrIaDp76KRmwc::FmSNfqClsUe9CQWQJZoYwGmi9KTjWxC0rGuMFqov0WPacWbP6Yvj06jWkYVgxYf80HqEWmHWgO4HyHIudZiN5YuX15sCGlRv()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Mutex MUTEXmalicious
YFVimjhuhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙