669d03f9d88272fe852903f4512ef0c3

PE Executable
|
MD5: 669d03f9d88272fe852903f4512ef0c3
|
Size: 497.15 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	669d03f9d88272fe852903f4512ef0c3
Sha1	4f038ead1be546dff055fef9f51cfba050ccb9e6
Sha256	8339d057c0369f28b6c71fff740206a8a2b8eca170b8e673dfecf2a782ee50a4
Sha384	c7c5191271e73cc4e0dec74b07a1ca8476f19f6c01fabc7f663b60bba0133c448a3e88a39898b25dfeb496d90515bdf6
Sha512	fdfe9864158c8bf7aea329ab04769d0d81915ddc1cfdbcab9aead07adc0b1b97e34bbed1f2d57e3b823d3e606e8060b05092e19ad5f3970bba544fa2675d652c
SSDeep	12288:dd3+fStokp+2XrbndTCdwo4cF4LZT6N3istI0vs8:dp+fSt7fXew8r3Pi0U8
TLSH	B3B4AD2EEAE0CF01DA5C1D30DEAB512447B2A5863E73F79E1B9811552D032F1A91E3E7

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	XWormClient.exe
Full Name	XWormClient.exe
EntryPoint	System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::Lxgdx5YSR()
Scope Name	XWormClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWormClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	44
Main Method	System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::Lxgdx5YSR()
Main IL Instruction Count	192
Main IL	br.s IL_0007: ldc.i4 5 call <null> ldc.i4 5 stloc V_0 br IL_0015: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_00C2: ldloc.s V_5 ldc.i4.0 <null> ldsfld rtm4nK1B1Xa37yiNxGA rtm4nK1B1Xa37yiNxGA::eKU1lHQ1KM call System.Void rtm4nK1B1Xa37yiNxGA::gWo1b6g0XE(System.Int32,rtm4nK1B1Xa37yiNxGA) ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_62e59d4f4ec64003ba0fe838877806ab brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 11 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld EKRiMX18UurgDrvP3fM EKRiMX18UurgDrvP3fM::eru1PDjdu2 call System.Void EKRiMX18UurgDrvP3fM::gWo1b6g0XE(EKRiMX18UurgDrvP3fM) ldc.i4 4 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldnull <null> ldftn System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_5 ldc.i4 9 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld CtCfVy1wKlN6d4B1tHQ CtCfVy1wKlN6d4B1tHQ::dZ214MDH5D call System.Void CtCfVy1wKlN6d4B1tHQ::gWo1b6g0XE(CtCfVy1wKlN6d4B1tHQ) ldc.i4 2 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldloc.s V_5 ldsfld jJlXWv1MdAPE0lXQEa9 jJlXWv1MdAPE0lXQEa9::hlw1dZQRT9 call System.Void jJlXWv1MdAPE0lXQEa9::gWo1b6g0XE(System.Object,jJlXWv1MdAPE0lXQEa9) ldc.i4 10 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_e60faa99d7aa4be5958f3c75e2d58b2a brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 6 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldloc.s V_4 ldsfld pvp0Oy1SQBLSG1Qyx1q pvp0Oy1SQBLSG1Qyx1q::KTR1c3V0BV call System.Void pvp0Oy1SQBLSG1Qyx1q::gWo1b6g0XE(System.Object,pvp0Oy1SQBLSG1Qyx1q) ldc.i4 3 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld OshOl016uO07JMppdxL OshOl016uO07JMppdxL::OcC1mKHFZo call System.Boolean OshOl016uO07JMppdxL::gWo1b6g0XE(OshOl016uO07JMppdxL) brtrue IL_00AE: ldsfld CtCfVy1wKlN6d4B1tHQ CtCfVy1wKlN6d4B1tHQ::dZ214MDH5D ldc.i4 7 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldloc.s V_4 ldsfld jJlXWv1MdAPE0lXQEa9 jJlXWv1MdAPE0lXQEa9::hlw1dZQRT9 call System.Void jJlXWv1MdAPE0lXQEa9::gWo1b6g0XE(System.Object,jJlXWv1MdAPE0lXQEa9) ldc.i4 3 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_e47d23c310d34b6ab0e53c04b1f78644 brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 6 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld System.Int32 HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::SeW6ZEGDG ldc.i4 1000 mul.ovf <null> ldsfld zH55iG1ptJ6vP4rjk5H zH55iG1ptJ6vP4rjk5H::CLu1uJM1d3 call System.Void zH55iG1ptJ6vP4rjk5H::gWo1b6g0XE(System.Int32,zH55iG1ptJ6vP4rjk5H) ldc.i4 1 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_004f70ff003446aaa726426bddbaa9b8 brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 1 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldnull <null> ldftn System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_4 ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_516b7b2149054317a35a78bbcf2b6edf brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 0 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ret <null> nop <null> ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::sTuvpUBq2 ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::sTuvpUBq2 ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_ba9383bd97bc4d618f152568b69ce185 brtrue IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 0 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_0212: ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::EuZlymZEt ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::EuZlymZEt ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::EuZlymZEt ldc.i4 1 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_b2d64dea878741fe8e64c3b7f4e28e6a brtrue IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 1 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::NojT1W65e ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::NojT1W65e ldc.i4 5 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_e1f95bfa39214be494531044294a2994 brfalse IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 2 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::BVG04WCmm ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::BVG04WCmm ldc.i4 4 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::WfAwiqWLT ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::WfAwiqWLT ldc.i4 3 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::dFgmjMrfj ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::dFgmjMrfj ldc.i4 2 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_5505bc8cff034a06a54a373db263ddd9 brtrue IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 1 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) leave IL_0103: ldsfld OshOl016uO07JMppdxL OshOl016uO07JMppdxL::OcC1mKHFZo dup <null> ldsfld DstkHN1gkPPRSOtnO6i DstkHN1gkPPRSOtnO6i::R3E1vO8Jpx call System.Void DstkHN1gkPPRSOtnO6i::gWo1b6g0XE(System.Exception,DstkHN1gkPPRSOtnO6i) stloc.s V_2 ldc.i4 1 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_78127299b49947efa61d5509cf18fec6 brfalse IL_034E: switch(IL_038E,IL_0364,IL_03A2) pop <null> ldc.i4 0 br IL_034E: switch(IL_038E,IL_0364,IL_03A2) ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_038E: ldsfld oCaEFq1TDOxOfrAEImu oCaEFq1TDOxOfrAEImu::qtg10gCMQS ldc.i4.0 <null> ldsfld rtm4nK1B1Xa37yiNxGA rtm4nK1B1Xa37yiNxGA::eKU1lHQ1KM call System.Void rtm4nK1B1Xa37yiNxGA::gWo1b6g0XE(System.Int32,rtm4nK1B1Xa37yiNxGA) ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_62e59d4f4ec64003ba0fe838877806ab brtrue IL_034E: switch(IL_038E,IL_0364,IL_03A2) pop <null> ldc.i4 0 br IL_034E: switch(IL_038E,IL_0364,IL_03A2) ldsfld oCaEFq1TDOxOfrAEImu oCaEFq1TDOxOfrAEImu::qtg10gCMQS call System.Void oCaEFq1TDOxOfrAEImu::gWo1b6g0XE(oCaEFq1TDOxOfrAEImu) ldc.i4 2 br IL_034E: switch(IL_038E,IL_0364,IL_03A2) leave IL_0103: ldsfld OshOl016uO07JMppdxL OshOl016uO07JMppdxL::OcC1mKHFZo ldc.i4 8 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE)
Module Name	XWormClient.exe
Full Name	XWormClient.exe
EntryPoint	System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::Lxgdx5YSR()
Scope Name	XWormClient.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	XWormClient
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	<null>
Total Strings	44
Main Method	System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::Lxgdx5YSR()
Main IL Instruction Count	192
Main IL	br.s IL_0007: ldc.i4 5 call <null> ldc.i4 5 stloc V_0 br IL_0015: ldloc V_0 ldloc V_0 switch dnlib.DotNet.Emit.Instruction[] br IL_00C2: ldloc.s V_5 ldc.i4.0 <null> ldsfld rtm4nK1B1Xa37yiNxGA rtm4nK1B1Xa37yiNxGA::eKU1lHQ1KM call System.Void rtm4nK1B1Xa37yiNxGA::gWo1b6g0XE(System.Int32,rtm4nK1B1Xa37yiNxGA) ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_62e59d4f4ec64003ba0fe838877806ab brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 11 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld EKRiMX18UurgDrvP3fM EKRiMX18UurgDrvP3fM::eru1PDjdu2 call System.Void EKRiMX18UurgDrvP3fM::gWo1b6g0XE(EKRiMX18UurgDrvP3fM) ldc.i4 4 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldnull <null> ldftn System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::_Lambda$__1() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_5 ldc.i4 9 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld CtCfVy1wKlN6d4B1tHQ CtCfVy1wKlN6d4B1tHQ::dZ214MDH5D call System.Void CtCfVy1wKlN6d4B1tHQ::gWo1b6g0XE(CtCfVy1wKlN6d4B1tHQ) ldc.i4 2 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldloc.s V_5 ldsfld jJlXWv1MdAPE0lXQEa9 jJlXWv1MdAPE0lXQEa9::hlw1dZQRT9 call System.Void jJlXWv1MdAPE0lXQEa9::gWo1b6g0XE(System.Object,jJlXWv1MdAPE0lXQEa9) ldc.i4 10 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_e60faa99d7aa4be5958f3c75e2d58b2a brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 6 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldloc.s V_4 ldsfld pvp0Oy1SQBLSG1Qyx1q pvp0Oy1SQBLSG1Qyx1q::KTR1c3V0BV call System.Void pvp0Oy1SQBLSG1Qyx1q::gWo1b6g0XE(System.Object,pvp0Oy1SQBLSG1Qyx1q) ldc.i4 3 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld OshOl016uO07JMppdxL OshOl016uO07JMppdxL::OcC1mKHFZo call System.Boolean OshOl016uO07JMppdxL::gWo1b6g0XE(OshOl016uO07JMppdxL) brtrue IL_00AE: ldsfld CtCfVy1wKlN6d4B1tHQ CtCfVy1wKlN6d4B1tHQ::dZ214MDH5D ldc.i4 7 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldloc.s V_4 ldsfld jJlXWv1MdAPE0lXQEa9 jJlXWv1MdAPE0lXQEa9::hlw1dZQRT9 call System.Void jJlXWv1MdAPE0lXQEa9::gWo1b6g0XE(System.Object,jJlXWv1MdAPE0lXQEa9) ldc.i4 3 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_e47d23c310d34b6ab0e53c04b1f78644 brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 6 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldsfld System.Int32 HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::SeW6ZEGDG ldc.i4 1000 mul.ovf <null> ldsfld zH55iG1ptJ6vP4rjk5H zH55iG1ptJ6vP4rjk5H::CLu1uJM1d3 call System.Void zH55iG1ptJ6vP4rjk5H::gWo1b6g0XE(System.Int32,zH55iG1ptJ6vP4rjk5H) ldc.i4 1 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_004f70ff003446aaa726426bddbaa9b8 brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 1 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ldnull <null> ldftn System.Void HEUNfkbqvmJvaKoCeG.p0D9NfM6o1GFxeVak7::_Lambda$__2() newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr) newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart) stloc.s V_4 ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_516b7b2149054317a35a78bbcf2b6edf brtrue IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) pop <null> ldc.i4 0 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE) ret <null> nop <null> ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::sTuvpUBq2 ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::sTuvpUBq2 ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_ba9383bd97bc4d618f152568b69ce185 brtrue IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 0 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldloc V_3 switch dnlib.DotNet.Emit.Instruction[] br IL_0212: ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::EuZlymZEt ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::EuZlymZEt ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::EuZlymZEt ldc.i4 1 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_b2d64dea878741fe8e64c3b7f4e28e6a brtrue IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 1 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::NojT1W65e ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::NojT1W65e ldc.i4 5 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_e1f95bfa39214be494531044294a2994 brfalse IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 2 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::BVG04WCmm ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::BVG04WCmm ldc.i4 4 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::WfAwiqWLT ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::WfAwiqWLT ldc.i4 3 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) ldsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::dFgmjMrfj ldsfld EGaBqB1j1vlQOd78Hr1 EGaBqB1j1vlQOd78Hr1::gKf1X8I5nY call System.Object EGaBqB1j1vlQOd78Hr1::gWo1b6g0XE(System.String,EGaBqB1j1vlQOd78Hr1) ldsfld VCHpgC1YaxYWwUvguko VCHpgC1YaxYWwUvguko::o9V1ee3KeU call System.String VCHpgC1YaxYWwUvguko::gWo1b6g0XE(System.Object,VCHpgC1YaxYWwUvguko) stsfld System.Object HEUNfkbqvmJvaKoCeG.YLnV80gwdCM08bww5S::dFgmjMrfj ldc.i4 2 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_5505bc8cff034a06a54a373db263ddd9 brtrue IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) pop <null> ldc.i4 1 br IL_01F0: switch(IL_0212,IL_024F,IL_02B4,IL_0319,IL_02DC,IL_028C) leave IL_0103: ldsfld OshOl016uO07JMppdxL OshOl016uO07JMppdxL::OcC1mKHFZo dup <null> ldsfld DstkHN1gkPPRSOtnO6i DstkHN1gkPPRSOtnO6i::R3E1vO8Jpx call System.Void DstkHN1gkPPRSOtnO6i::gWo1b6g0XE(System.Exception,DstkHN1gkPPRSOtnO6i) stloc.s V_2 ldc.i4 1 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_78127299b49947efa61d5509cf18fec6 brfalse IL_034E: switch(IL_038E,IL_0364,IL_03A2) pop <null> ldc.i4 0 br IL_034E: switch(IL_038E,IL_0364,IL_03A2) ldloc V_1 switch dnlib.DotNet.Emit.Instruction[] br IL_038E: ldsfld oCaEFq1TDOxOfrAEImu oCaEFq1TDOxOfrAEImu::qtg10gCMQS ldc.i4.0 <null> ldsfld rtm4nK1B1Xa37yiNxGA rtm4nK1B1Xa37yiNxGA::eKU1lHQ1KM call System.Void rtm4nK1B1Xa37yiNxGA::gWo1b6g0XE(System.Int32,rtm4nK1B1Xa37yiNxGA) ldc.i4 0 ldsfld <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e} <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_132dc554c211449eb8e33aa6ce6a845d ldfld System.Int32 <Module>{02234774-7dd1-49c2-8186-93d3ce76ba0e}::m_62e59d4f4ec64003ba0fe838877806ab brtrue IL_034E: switch(IL_038E,IL_0364,IL_03A2) pop <null> ldc.i4 0 br IL_034E: switch(IL_038E,IL_0364,IL_03A2) ldsfld oCaEFq1TDOxOfrAEImu oCaEFq1TDOxOfrAEImu::qtg10gCMQS call System.Void oCaEFq1TDOxOfrAEImu::gWo1b6g0XE(oCaEFq1TDOxOfrAEImu) ldc.i4 2 br IL_034E: switch(IL_038E,IL_0364,IL_03A2) leave IL_0103: ldsfld OshOl016uO07JMppdxL OshOl016uO07JMppdxL::OcC1mKHFZo ldc.i4 8 br IL_0019: switch(IL_00C2,IL_01AE,IL_0091,IL_01AD,IL_0147,IL_007D,IL_00ED,IL_0053,IL_0103,IL_017B,IL_011C,IL_00AE)

669d03f9d88272fe852903f4512ef0c3 (497.15 KB)

669d03f9d88272fe852903f4512ef0c3

PE Executable | MD5: 669d03f9d88272fe852903f4512ef0c3 | Size: 497.15 KB | application/x-dosexec

PE Executable
|
MD5: 669d03f9d88272fe852903f4512ef0c3
|
Size: 497.15 KB
|
application/x-dosexec