Deep Malware Analysis of 3b9ed3e8ff3d78eb830a0b1b1ddce8c6 | md5: 3b9ed3e8ff3d78eb830a0b1b1ddce8c6 | Executable | PE (Portable Executable) | Managed .NET | PE File Layout | Win 32 Exe | x86 | .Net | SOS: 0.84

PE Executable

MD5: 3b9ed3e8ff3d78eb830a0b1b1ddce8c6

Size: 1.86 MB

application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.

Unlock with Essential

Symbol Obfuscation Score Very high

MD5	3b9ed3e8ff3d78eb830a0b1b1ddce8c6
Sha1	6cdd5534239367863740c493e219129208c8ea63
Sha256	7754fc3ae79dd10fdb5f3a04251eb2e87ecf281597c058b27ae852083cf71ab4
Sha384	28d3f6864ab5ea7498d51e522a172f8e7eb2931495dd57212bbdb8df4ef91ffbf738a1b3cf0242647c737f18852c7243
Sha512	a6caefe2ab816e98ba9bca8700961cd3c696a3ebb42de10241df820a7852ab6a3b8c4a205c232828ca79005e91697d285f19ff26dd2ebc0f4a85f4a4c84fe4b5
SSDeep	24576:Em/bxnqVz78GIEJ68eR0/eS9BrVXqI+aRb:EmTxnqVzINS/pVaI/V
TLSH	E285F1055F462F89E1AE0F7DC0522855B3F4C44372E6D29A3FF9A0B62E93FC5DA16290

PeID

.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET

Name	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	5ofWe4Ks0jq
Full Name	5ofWe4Ks0jq
EntryPoint	System.Void cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w::bAr58wyHtJc2()
Scope Name	5ofWe4Ks0jq
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	5ofWe4Ks0jq
Assembly Version	1.27.47.151
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	0
Main Method	System.Void cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w::bAr58wyHtJc2()
Main IL Instruction Count	299
Main IL	ldsfld System.Char[] iW_76sgD.Qrc63Cbome::pJg37y stloc.s V_30 nop <null> br.s IL_000A: ldc.i4.1 ldc.i4.1 <null> stloc.s V_21 ldloc.s V_21 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0042: nop nop <null> call System.Guid System.Guid::NewGuid() stloc.s V_12 ldloca.s V_12 nop <null> ldc.i4.3 <null> ldc.i4.s 10 ldc.i4 232616653 call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1::Aif3n8(System.Int32,System.Byte,System.Int32) call System.String System.Guid::ToString(System.String) ldc.i4.0 <null> ldc.i4.8 <null> callvirt System.String System.String::Substring(System.Int32,System.Int32) stloc.1 <null> ldc.i4.8 <null> stloc.s V_21 br.s IL_000D: ldloc.s V_21 call System.Int32 System.Environment::get_ProcessorCount() stloc.2 <null> call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture() call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo) nop <null> nop <null> ldc.i4.s 27 ldnull <null> ldc.i4 929282219 ldc.i4.6 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) stloc.3 <null> ldc.i4.2 <null> stloc.s V_21 br IL_000D: ldloc.s V_21 ldloc.3 <null> ldloca.s V_4 call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&) pop <null> call System.OperatingSystem System.Environment::get_OSVersion() callvirt System.Version System.OperatingSystem::get_Version() callvirt System.String System.Version::ToString() stloc.s V_5 call System.Version System.Environment::get_Version() callvirt System.String System.Version::ToString() stloc.s V_6 ldc.i4.s 9 stloc.s V_21 br IL_000D: ldloc.s V_21 newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor() stloc.s V_7 ldloc.s V_7 call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object) nop <null> ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) nop <null> ldc.i4 799794015 ldtoken cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w/Rp0x9ekEZx2.7Mf_o9 call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) ldc.i4.7 <null> ldnull <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1::8b_MexX56Rataz(System.Int32,System.Type,System.Int32,System.String) nop <null> ldc.i4.s 17 ldnull <null> ldc.i4 929282202 ldc.i4.2 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_8 ldc.i4.5 <null> stloc.s V_21 br IL_000D: ldloc.s V_21 ldloc.s V_7 callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count() ldc.i4.0 <null> ceq <null> stloc.s V_13 ldloc.s V_13 brfalse.s IL_012C: ldc.i4.4 ldc.i4.3 <null> stloc.s V_21 br IL_000D: ldloc.s V_21 ldc.i4.4 <null> br.s IL_0125: stloc.s V_21 leave IL_0392: ret nop <null> br.s IL_0137: br.s IL_0139 br.s IL_0139: ldc.i4.8 ldc.i4.8 <null> stloc.s V_23 ldloc.s V_23 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0175: ldloc.s V_7 ldloc.s V_7 ldc.i4.0 <null> callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32) ldnull <null> nop <null> ldc.i4 799794027 ldtoken cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w/Pbs8g5xD2rBrQ.Mk9z7ijFXp call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) ldc.i4.5 <null> ldnull <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1::8b_MexX56Rataz(System.Int32,System.Type,System.Int32,System.String) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Collections.IEnumerable callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator() stloc.s V_14 ldc.i4.s 11 stloc.s V_23 br.s IL_013C: ldloc.s V_23 ldloc.s V_14 callvirt System.Object System.Collections.IEnumerator::get_Current() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_15 ldloc.s V_15 brtrue.s IL_01D0: ldc.i4.s 10 ldc.i4.s 9 stloc.s V_23 br IL_013C: ldloc.s V_23 ldc.i4.s 10 br.s IL_01C9: stloc.s V_23 ldnull <null> br.s IL_0216: ldc.i4.1 ldloc.s V_15 ldnull <null> nop <null> ldc.i4.s 24 ldnull <null> ldc.i4 929282188 ldc.i4.2 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.3 <null> nop <null> ldc.i4 2050021952 ldc.i4.5 <null> ldtoken cp1HWkk6j4Se.Rfe0kL4bBa/6kcAeF1k4bWn_j.qXs95sHqe call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/4JxfgbD.Me6y1Gcj::Hy1t8wsGnb(System.Int32,System.Int32,System.Type) call System.String System.String::Concat(System.String,System.String) stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldc.i4.1 <null> box System.Boolean ldc.i4.0 <null> call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean) stloc.s V_16 ldloc.s V_16 brfalse.s IL_0230: ldc.i4.7 ldc.i4.6 <null> stloc.s V_23 br IL_013C: ldloc.s V_23 ldc.i4.7 <null> br.s IL_0229: stloc.s V_23 ldloc.s V_7 ldloc.s V_15 call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object) nop <null> ldc.i4.1 <null> stloc.s V_23 br IL_013C: ldloc.s V_23 nop <null> nop <null> ldc.i4.s 11 stloc.s V_23 br IL_013C: ldloc.s V_23 ldloc.s V_14 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() stloc.s V_17 ldloc.s V_17 brtrue.s IL_026A: ldc.i4.5 ldc.i4.1 <null> stloc.s V_23 br IL_013C: ldloc.s V_23 ldc.i4.5 <null> br.s IL_0263: stloc.s V_23 leave.s IL_02BD: br.s IL_02BF br.s IL_0271: ldc.i4.3 ldc.i4.3 <null> stloc.s V_25 ldloc.s V_25 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0299: ldloc.s V_14 ldloc.s V_14 isinst System.IDisposable brfalse.s IL_02A7: ldc.i4.6 ldc.i4.2 <null> stloc.s V_25 br.s IL_0274: ldloc.s V_25 ldc.i4.6 <null> br.s IL_02A3: stloc.s V_25 ldloc.s V_14 isinst System.IDisposable callvirt System.Void System.IDisposable::Dispose() nop <null> ldc.i4.6 <null> stloc.s V_25 br.s IL_0274: ldloc.s V_25 endfinally <null> br.s IL_02BF: ldc.i4.3 ldc.i4.3 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] br.s IL_02E3: nop nop <null> ldc.i4.s 29 ldnull <null> ldc.i4 929282293 ldc.i4.0 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) ldloc.3 <null> call System.String System.String::Format(System.String,System.Object) stloc.s V_9 ldc.i4.1 <null> stloc.s V_10 ldc.i4.4 <null> stloc.s V_27 br.s IL_02C2: ldloc.s V_27 ldloc.s V_7 call System.Void Skn6d9_LXn.Kwi4d5sJ/Dx7d0akF.ij8PE6sq9mYq::0Agxgj9Y(System.Collections.Generic.List`1<System.Object>) nop <null> ldc.i4.1 <null> stloc.s V_11 leave.s IL_0323: br.s IL_0325 br.s IL_0311: br.s IL_0313 br.s IL_0313: dup dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_18 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0323: br.s IL_0325 br.s IL_0325: ldc.i4.5 ldc.i4.5 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0351: nop nop <null> ldc.r8 1 stloc.0 <null> ldc.i4.1 <null> stloc.s V_19 ldloc.s V_30 ldc.i4.s 14 ldelem.u2 <null> ldc.i4 54459 sub <null> stloc.s V_29 br.s IL_0328: ldloc.s V_29 ldloc.0 <null> ldloc.s V_19 ldc.i4.1 <null> add.ovf <null> conv.r8 <null> div <null> stloc.0 <null> ldloc.s V_19 ldc.i4.1 <null> add.ovf <null> stloc.s V_19 ldc.i4.1 <null> stloc.s V_29 br.s IL_0328: ldloc.s V_29 ldloc.s V_19 ldc.i4 5000 ble.s IL_038F: ldc.i4.7 ldc.i4.3 <null> stloc.s V_29 br.s IL_0328: ldloc.s V_29 ldc.i4.7 <null> br.s IL_038B: stloc.s V_29 ret <null> ldtoken System.Void cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w::bAr58wyHtJc2() pop <null> ret <null>
Module Name	5ofWe4Ks0jq
Full Name	5ofWe4Ks0jq
EntryPoint	System.Void cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w::bAr58wyHtJc2()
Scope Name	5ofWe4Ks0jq
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	5ofWe4Ks0jq
Assembly Version	1.27.47.151
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.6
Total Strings	0
Main Method	System.Void cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w::bAr58wyHtJc2()
Main IL Instruction Count	299
Main IL	ldsfld System.Char[] iW_76sgD.Qrc63Cbome::pJg37y stloc.s V_30 nop <null> br.s IL_000A: ldc.i4.1 ldc.i4.1 <null> stloc.s V_21 ldloc.s V_21 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0042: nop nop <null> call System.Guid System.Guid::NewGuid() stloc.s V_12 ldloca.s V_12 nop <null> ldc.i4.3 <null> ldc.i4.s 10 ldc.i4 232616653 call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1::Aif3n8(System.Int32,System.Byte,System.Int32) call System.String System.Guid::ToString(System.String) ldc.i4.0 <null> ldc.i4.8 <null> callvirt System.String System.String::Substring(System.Int32,System.Int32) stloc.1 <null> ldc.i4.8 <null> stloc.s V_21 br.s IL_000D: ldloc.s V_21 call System.Int32 System.Environment::get_ProcessorCount() stloc.2 <null> call System.Globalization.CultureInfo System.Globalization.CultureInfo::get_InvariantCulture() call System.Void System.Globalization.CultureInfo::set_CurrentCulture(System.Globalization.CultureInfo) nop <null> nop <null> ldc.i4.s 27 ldnull <null> ldc.i4 929282219 ldc.i4.6 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) stloc.3 <null> ldc.i4.2 <null> stloc.s V_21 br IL_000D: ldloc.s V_21 ldloc.3 <null> ldloca.s V_4 call System.Boolean System.DateTime::TryParse(System.String,System.DateTime&) pop <null> call System.OperatingSystem System.Environment::get_OSVersion() callvirt System.Version System.OperatingSystem::get_Version() callvirt System.String System.Version::ToString() stloc.s V_5 call System.Version System.Environment::get_Version() callvirt System.String System.Version::ToString() stloc.s V_6 ldc.i4.s 9 stloc.s V_21 br IL_000D: ldloc.s V_21 newobj System.Void System.Collections.Generic.List`1<System.Object>::.ctor() stloc.s V_7 ldloc.s V_7 call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object) nop <null> ldc.i4.s 28 call System.String System.Environment::GetFolderPath(System.Environment/SpecialFolder) nop <null> ldc.i4 799794015 ldtoken cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w/Rp0x9ekEZx2.7Mf_o9 call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) ldc.i4.7 <null> ldnull <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1::8b_MexX56Rataz(System.Int32,System.Type,System.Int32,System.String) nop <null> ldc.i4.s 17 ldnull <null> ldc.i4 929282202 ldc.i4.2 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) call System.String System.IO.Path::Combine(System.String,System.String,System.String) stloc.s V_8 ldc.i4.5 <null> stloc.s V_21 br IL_000D: ldloc.s V_21 ldloc.s V_7 callvirt System.Int32 System.Collections.Generic.List`1<System.Object>::get_Count() ldc.i4.0 <null> ceq <null> stloc.s V_13 ldloc.s V_13 brfalse.s IL_012C: ldc.i4.4 ldc.i4.3 <null> stloc.s V_21 br IL_000D: ldloc.s V_21 ldc.i4.4 <null> br.s IL_0125: stloc.s V_21 leave IL_0392: ret nop <null> br.s IL_0137: br.s IL_0139 br.s IL_0139: ldc.i4.8 ldc.i4.8 <null> stloc.s V_23 ldloc.s V_23 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0175: ldloc.s V_7 ldloc.s V_7 ldc.i4.0 <null> callvirt System.Object System.Collections.Generic.List`1<System.Object>::get_Item(System.Int32) ldnull <null> nop <null> ldc.i4 799794027 ldtoken cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w/Pbs8g5xD2rBrQ.Mk9z7ijFXp call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) ldc.i4.5 <null> ldnull <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1::8b_MexX56Rataz(System.Int32,System.Type,System.Int32,System.String) ldc.i4.0 <null> newarr System.Object ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) castclass System.Collections.IEnumerable callvirt System.Collections.IEnumerator System.Collections.IEnumerable::GetEnumerator() stloc.s V_14 ldc.i4.s 11 stloc.s V_23 br.s IL_013C: ldloc.s V_23 ldloc.s V_14 callvirt System.Object System.Collections.IEnumerator::get_Current() call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) stloc.s V_15 ldloc.s V_15 brtrue.s IL_01D0: ldc.i4.s 10 ldc.i4.s 9 stloc.s V_23 br IL_013C: ldloc.s V_23 ldc.i4.s 10 br.s IL_01C9: stloc.s V_23 ldnull <null> br.s IL_0216: ldc.i4.1 ldloc.s V_15 ldnull <null> nop <null> ldc.i4.s 24 ldnull <null> ldc.i4 929282188 ldc.i4.2 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) ldc.i4.1 <null> newarr System.Object dup <null> ldc.i4.0 <null> ldloc.3 <null> nop <null> ldc.i4 2050021952 ldc.i4.5 <null> ldtoken cp1HWkk6j4Se.Rfe0kL4bBa/6kcAeF1k4bWn_j.qXs95sHqe call System.Type System.Type::GetTypeFromHandle(System.RuntimeTypeHandle) call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/4JxfgbD.Me6y1Gcj::Hy1t8wsGnb(System.Int32,System.Int32,System.Type) call System.String System.String::Concat(System.String,System.String) stelem.ref <null> ldnull <null> ldnull <null> ldnull <null> call System.Object Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) ldc.i4.1 <null> box System.Boolean ldc.i4.0 <null> call System.Boolean Microsoft.VisualBasic.CompilerServices.Operators::ConditionalCompareObjectEqual(System.Object,System.Object,System.Boolean) stloc.s V_16 ldloc.s V_16 brfalse.s IL_0230: ldc.i4.7 ldc.i4.6 <null> stloc.s V_23 br IL_013C: ldloc.s V_23 ldc.i4.7 <null> br.s IL_0229: stloc.s V_23 ldloc.s V_7 ldloc.s V_15 call System.Object System.Runtime.CompilerServices.RuntimeHelpers::GetObjectValue(System.Object) callvirt System.Void System.Collections.Generic.List`1<System.Object>::Add(System.Object) nop <null> ldc.i4.1 <null> stloc.s V_23 br IL_013C: ldloc.s V_23 nop <null> nop <null> ldc.i4.s 11 stloc.s V_23 br IL_013C: ldloc.s V_23 ldloc.s V_14 callvirt System.Boolean System.Collections.IEnumerator::MoveNext() stloc.s V_17 ldloc.s V_17 brtrue.s IL_026A: ldc.i4.5 ldc.i4.1 <null> stloc.s V_23 br IL_013C: ldloc.s V_23 ldc.i4.5 <null> br.s IL_0263: stloc.s V_23 leave.s IL_02BD: br.s IL_02BF br.s IL_0271: ldc.i4.3 ldc.i4.3 <null> stloc.s V_25 ldloc.s V_25 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0299: ldloc.s V_14 ldloc.s V_14 isinst System.IDisposable brfalse.s IL_02A7: ldc.i4.6 ldc.i4.2 <null> stloc.s V_25 br.s IL_0274: ldloc.s V_25 ldc.i4.6 <null> br.s IL_02A3: stloc.s V_25 ldloc.s V_14 isinst System.IDisposable callvirt System.Void System.IDisposable::Dispose() nop <null> ldc.i4.6 <null> stloc.s V_25 br.s IL_0274: ldloc.s V_25 endfinally <null> br.s IL_02BF: ldc.i4.3 ldc.i4.3 <null> stloc.s V_27 ldloc.s V_27 switch dnlib.DotNet.Emit.Instruction[] br.s IL_02E3: nop nop <null> ldc.i4.s 29 ldnull <null> ldc.i4 929282293 ldc.i4.0 <null> call System.String Mac94JeajxW0f2.Ji1kasK8Gm0z9d/4Qppii5JS.3DxfMs1/2zaQE9byga.6AymGc::rp2R4sNokB0o(System.Byte,System.String,System.Int32,System.Int32) ldloc.3 <null> call System.String System.String::Format(System.String,System.Object) stloc.s V_9 ldc.i4.1 <null> stloc.s V_10 ldc.i4.4 <null> stloc.s V_27 br.s IL_02C2: ldloc.s V_27 ldloc.s V_7 call System.Void Skn6d9_LXn.Kwi4d5sJ/Dx7d0akF.ij8PE6sq9mYq::0Agxgj9Y(System.Collections.Generic.List`1<System.Object>) nop <null> ldc.i4.1 <null> stloc.s V_11 leave.s IL_0323: br.s IL_0325 br.s IL_0311: br.s IL_0313 br.s IL_0313: dup dup <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception) stloc.s V_18 nop <null> call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError() leave.s IL_0323: br.s IL_0325 br.s IL_0325: ldc.i4.5 ldc.i4.5 <null> stloc.s V_29 ldloc.s V_29 switch dnlib.DotNet.Emit.Instruction[] br.s IL_0351: nop nop <null> ldc.r8 1 stloc.0 <null> ldc.i4.1 <null> stloc.s V_19 ldloc.s V_30 ldc.i4.s 14 ldelem.u2 <null> ldc.i4 54459 sub <null> stloc.s V_29 br.s IL_0328: ldloc.s V_29 ldloc.0 <null> ldloc.s V_19 ldc.i4.1 <null> add.ovf <null> conv.r8 <null> div <null> stloc.0 <null> ldloc.s V_19 ldc.i4.1 <null> add.ovf <null> stloc.s V_19 ldc.i4.1 <null> stloc.s V_29 br.s IL_0328: ldloc.s V_29 ldloc.s V_19 ldc.i4 5000 ble.s IL_038F: ldc.i4.7 ldc.i4.3 <null> stloc.s V_29 br.s IL_0328: ldloc.s V_29 ldc.i4.7 <null> br.s IL_038B: stloc.s V_29 ret <null> ldtoken System.Void cp1HWkk6j4Se.Rfe0kL4bBa/9cpHaL1cis.5Tgg_w::bAr58wyHtJc2() pop <null> ret <null>

No malware configuration was found at this point.

You must be signed in to view YARA rules.