Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 11 files
EXE85e8abb0e0335b1b4453e84b9dd466b0
Structure
Name Value
Module Name
WindowsManagerClient.exe
Full Name
WindowsManagerClient.exe
EntryPoint
System.Void M62E9tzyoakbS0df5w.l9QUHg7cy6VAHvsip3::<Main>(System.String[])
Scope Name
WindowsManagerClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WindowsManagerClient
Assembly Version
28.33.10.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
44
Main Method
System.Void M62E9tzyoakbS0df5w.l9QUHg7cy6VAHvsip3::<Main>(System.String[])
Main IL Instruction Count
37
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
br IL_0015: ldloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0033: ldarg.0
ldarg.0 <null>
call System.Threading.Tasks.Task M62E9tzyoakbS0df5w.l9QUHg7cy6VAHvsip3::xtTRwhEIFN(System.Object)
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.s V_0
ldc.i4 0
ldsfld <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92} <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_87007c137fda429a91736b3672738de7
ldfld System.Int32 <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_69b600924f994c378a7adbaa692cadcc
brtrue IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
pop <null>
ldc.i4 2
br IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
ret <null>
call System.Void f76hwiOkTgQJy0y1hHf.beBN9IOfa8kUtNPZTTI::e2qP2vTQv4()
ldc.i4 0
ldsfld <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92} <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_87007c137fda429a91736b3672738de7
ldfld System.Int32 <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_69b600924f994c378a7adbaa692cadcc
brtrue IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
ldloca.s V_0
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ldc.i4 3
ldsfld <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92} <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_87007c137fda429a91736b3672738de7
ldfld System.Int32 <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_b94fd9be920e43e89f9b0d88b3140fad
brfalse IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
pop <null>
ldc.i4 3
br IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
Module Name
WindowsManagerClient.exe
Full Name
WindowsManagerClient.exe
EntryPoint
System.Void M62E9tzyoakbS0df5w.l9QUHg7cy6VAHvsip3::<Main>(System.String[])
Scope Name
WindowsManagerClient.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
WindowsManagerClient
Assembly Version
28.33.10.1
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
.NETFramework,Version=v4.8
Total Strings
44
Main Method
System.Void M62E9tzyoakbS0df5w.l9QUHg7cy6VAHvsip3::<Main>(System.String[])
Main IL Instruction Count
37
Main IL 
br.s IL_0007: ldc.i4 1
call <null>
ldc.i4 1
stloc V_1
br IL_0015: ldloc V_1
ldloc V_1
switch dnlib.DotNet.Emit.Instruction[]
br IL_0033: ldarg.0
ldarg.0 <null>
call System.Threading.Tasks.Task M62E9tzyoakbS0df5w.l9QUHg7cy6VAHvsip3::xtTRwhEIFN(System.Object)
callvirt System.Runtime.CompilerServices.TaskAwaiter System.Threading.Tasks.Task::GetAwaiter()
stloc.s V_0
ldc.i4 0
ldsfld <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92} <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_87007c137fda429a91736b3672738de7
ldfld System.Int32 <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_69b600924f994c378a7adbaa692cadcc
brtrue IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
pop <null>
ldc.i4 2
br IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
ret <null>
call System.Void f76hwiOkTgQJy0y1hHf.beBN9IOfa8kUtNPZTTI::e2qP2vTQv4()
ldc.i4 0
ldsfld <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92} <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_87007c137fda429a91736b3672738de7
ldfld System.Int32 <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_69b600924f994c378a7adbaa692cadcc
brtrue IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
pop <null>
ldc.i4 0
br IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
ldloca.s V_0
call System.Void System.Runtime.CompilerServices.TaskAwaiter::GetResult()
ldc.i4 3
ldsfld <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92} <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_87007c137fda429a91736b3672738de7
ldfld System.Int32 <Module>{dec4440b-b3d5-494a-b67c-6bc8d6787c92}::m_b94fd9be920e43e89f9b0d88b3140fad
brfalse IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
pop <null>
ldc.i4 3
br IL_0019: switch(IL_0033,IL_0060,IL_0084,IL_005F)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙