Malicious
Malicious

3f924a568b81cddd3f7fdbcc19721edf

PE Executable
MD5: 3f924a568b81cddd3f7fdbcc19721edf
Size: 25.6 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 3f924a568b81cddd3f7fdbcc19721edf
Sha1 fe41aa1fce4a41a11da253af51497ed86774fefb
Sha256 5f8208c4790ca7b7aa199cf9ae09933bef089e0f86df853b17b59c14e7aa3fab
Sha384 93759177ccf80f6c74a6e0665852a78e5764038e90e38359416f795c1221568c5510166dd7f21c1fb0aba022bb80487e
Sha512 51a2ca17fc28da807b93ccd48e2cca811c2fb189beb66c857428f7801c768b66fc91399669d7a63154a1a63243184de592aa8699ee71be740fc96a55b49b4ba4
SSDeep 384:pxysR3YvF6Ykd4dQ9RjQfTW4gCwL1WCb+Pi5kyiNVj+n2c:pwLndQ9dwIv1WCbJINQ2c
TLSH A3B23A897A98C62DD67F4B7C71F307200372E306512AEF85ADC85DAE6DA732408217DB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3f924a568b81cddd3f7fdbcc19721edf
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
run.ps1
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:ps1~T1027~T1059.001~T1105
Shape pe:exe>scr:ps1
malicious 2 nodes
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
install.exe
Full Name
install.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
install.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
install
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
77
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
583
Info
PE Detect: PeReader OK (file layout)
Main IL 
ldnull <null>
stloc.s V_26
ldnull <null>
stloc.s V_27
ldnull <null>
stloc.s V_28
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::.ctor()
stloc.s V_29
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_29
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.0 <null>
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_29
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
ldloc.s V_4
callvirt System.Management.Automation.Runspaces.SessionStateProxy System.Management.Automation.Runspaces.Runspace::get_SessionStateProxy()
ldstr ScriptRoot
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_31
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.Void System.Management.Automation.Runspaces.SessionStateProxy::SetVariable(System.String,System.Object)
ldnull <null>
stloc.s V_23
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::.ctor()
stloc.s V_24
ldloc.s V_24
ldloc.s V_29
stfld ModuleNameSpace.MainApp/<>c__DisplayClass8 ModuleNameSpace.MainApp/<>c__DisplayClassb::CS$<>8__locals9
ldloc.s V_24
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_23
brtrue.s IL_00D4: ldloc.s V_23
ldloc.s V_24
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::<Main>b__0(System.Object,System.ConsoleCancelEventArgs)
newobj System.Void System.ConsoleCancelEventHandler::.ctor(System.Object,System.IntPtr)
stloc.s V_23
ldloc.s V_23
call System.Void System.Console::add_CancelKeyPress(System.ConsoleCancelEventHandler)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_26
brtrue.s IL_010D: ldloc.s V_26
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__2(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_5
call System.Boolean System.Console::get_IsInputRedirected()
brfalse.s IL_013E: ldloc.s V_5
ldstr 
stloc.s V_6
br.s IL_0134: call System.String System.Console::ReadLine()
ldloc.s V_5
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_6
brtrue.s IL_012B: ldloc.s V_5
ldloc.s V_5
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_7
ldloc.s V_7
ldloc.s V_27
brtrue.s IL_0161: ldloc.s V_27
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__3(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_27
ldloc.s V_27
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_8
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldstr 
stloc.s V_11
ldarg.0 <null>
stloc.s V_32
ldc.i4.0 <null>
stloc.s V_33
br IL_0287: ldloc.s V_33
ldloc.s V_32
ldloc.s V_33
ldelem.ref <null>
stloc.s V_12
ldloc.s V_12
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01A0: ldloc.s V_12
ldc.i4.1 <null>
stloc.1 <null>
br IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_0202: ldloc.s V_12
ldloc.s V_12
ldc.i4.1 <null>
newarr System.String
stloc.s V_34
ldloc.s V_34
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_34
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_13
ldloc.s V_13
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_01E6: ldloc.s V_13
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.Void System.Console::WriteLine(System.String)
ldc.i4.1 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_13
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_35
ldloc.s V_35
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_35
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0219: ldloc.s V_12
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_8
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_12
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_022D: ldloc.s V_10
ldc.i4.1 <null>
stloc.s V_10
br.s IL_027B: ldloc.s V_9
ldloc.s V_10
brfalse.s IL_0264: ldloc.s V_12
ldloc.s V_12
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
ldloc.s V_12
stloc.s V_11
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_9
ldloc.s V_33
ldc.i4.1 <null>
add <null>
stloc.s V_33
ldloc.s V_33
ldloc.s V_32
ldlen <null>
conv.i4 <null>
blt IL_0183: ldloc.s V_32
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_14
ldloc.s V_14
ldstr run.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_15
ldloc.s V_15
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_16
ldloc.s V_16
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_17
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_02D6: ldloc.s V_10
ldloc.2 <null>
ldloc.s V_17
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_10
brfalse.s IL_034E: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldc.i4.s 9
newarr System.String
stloc.s V_36
ldloc.s V_36
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_36
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_36
ldc.i4.3 <null>
ldloc.s V_17
stelem.ref <null>
ldloc.s V_36
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_36
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_36
ldc.i4.7 <null>
ldloc.s V_11
stelem.ref <null>
ldloc.s V_36
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_36
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_035D: leave.s IL_036B
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_17
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_036B: leave.s IL_0379
ldloc.s V_16
brfalse.s IL_036A: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0379: ldloc.s V_10
ldloc.s V_15
brfalse.s IL_0378: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_10
brtrue IL_05A5: ldloc.s V_24
ldnull <null>
stloc.s V_18
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_19
ldloc.s V_8
stloc.s V_20
br IL_0564: ldloc.s V_20
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_21
ldloc.s V_21
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_0531: ldloc.s V_18
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_0531: ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
ldloca.s V_22
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_0531: ldloc.s V_18
ldloc.s V_18
brfalse.s IL_03E6: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0422: ldloc.s V_21
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0463: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0490: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_04D1: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_04FB: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_18
brfalse.s IL_054D: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_20
ldc.i4.1 <null>
add <null>
stloc.s V_20
ldloc.s V_20
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0398: ldloc.s V_19
ldloc.s V_18
brfalse.s IL_0581: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_5
ldloc.s V_7
ldnull <null>
ldloc.s V_28
brtrue.s IL_05C4: ldloc.s V_28
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__4(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_28
ldloc.s V_28
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_05E5: ldloc.s V_24
ldloc.s V_29
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_05CD: ldloc.0
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_0627: leave.s IL_063F
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_063F: ldloc.s V_4
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
brfalse.s IL_063E: endfinally
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_0654: leave.s IL_0670
ldloc.s V_4
brfalse.s IL_0653: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0670: ldloc.1
stloc.s V_25
ldstr An exception occured: 
call System.Void System.Console::Write(System.String)
ldloc.s V_25
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0670: ldloc.1
ldloc.1 <null>
brfalse.s IL_0683: ldloc.0
ldstr Hit any key to exit...
call System.Void System.Console::WriteLine(System.String)
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_30
ret <null>
Module Name
install.exe
Full Name
install.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
install.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
install
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
77
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
583
Main IL 
ldnull <null>
stloc.s V_26
ldnull <null>
stloc.s V_27
ldnull <null>
stloc.s V_28
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::.ctor()
stloc.s V_29
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_29
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.0 <null>
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_29
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
ldloc.s V_4
callvirt System.Management.Automation.Runspaces.SessionStateProxy System.Management.Automation.Runspaces.Runspace::get_SessionStateProxy()
ldstr ScriptRoot
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_31
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.Void System.Management.Automation.Runspaces.SessionStateProxy::SetVariable(System.String,System.Object)
ldnull <null>
stloc.s V_23
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::.ctor()
stloc.s V_24
ldloc.s V_24
ldloc.s V_29
stfld ModuleNameSpace.MainApp/<>c__DisplayClass8 ModuleNameSpace.MainApp/<>c__DisplayClassb::CS$<>8__locals9
ldloc.s V_24
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_23
brtrue.s IL_00D4: ldloc.s V_23
ldloc.s V_24
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::<Main>b__0(System.Object,System.ConsoleCancelEventArgs)
newobj System.Void System.ConsoleCancelEventHandler::.ctor(System.Object,System.IntPtr)
stloc.s V_23
ldloc.s V_23
call System.Void System.Console::add_CancelKeyPress(System.ConsoleCancelEventHandler)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_26
brtrue.s IL_010D: ldloc.s V_26
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__2(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_5
call System.Boolean System.Console::get_IsInputRedirected()
brfalse.s IL_013E: ldloc.s V_5
ldstr 
stloc.s V_6
br.s IL_0134: call System.String System.Console::ReadLine()
ldloc.s V_5
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_6
brtrue.s IL_012B: ldloc.s V_5
ldloc.s V_5
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_7
ldloc.s V_7
ldloc.s V_27
brtrue.s IL_0161: ldloc.s V_27
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__3(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_27
ldloc.s V_27
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_8
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldstr 
stloc.s V_11
ldarg.0 <null>
stloc.s V_32
ldc.i4.0 <null>
stloc.s V_33
br IL_0287: ldloc.s V_33
ldloc.s V_32
ldloc.s V_33
ldelem.ref <null>
stloc.s V_12
ldloc.s V_12
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01A0: ldloc.s V_12
ldc.i4.1 <null>
stloc.1 <null>
br IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_0202: ldloc.s V_12
ldloc.s V_12
ldc.i4.1 <null>
newarr System.String
stloc.s V_34
ldloc.s V_34
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_34
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_13
ldloc.s V_13
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_01E6: ldloc.s V_13
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.Void System.Console::WriteLine(System.String)
ldc.i4.1 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_13
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_35
ldloc.s V_35
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_35
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0219: ldloc.s V_12
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_8
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_12
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_022D: ldloc.s V_10
ldc.i4.1 <null>
stloc.s V_10
br.s IL_027B: ldloc.s V_9
ldloc.s V_10
brfalse.s IL_0264: ldloc.s V_12
ldloc.s V_12
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
ldloc.s V_12
stloc.s V_11
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_9
ldloc.s V_33
ldc.i4.1 <null>
add <null>
stloc.s V_33
ldloc.s V_33
ldloc.s V_32
ldlen <null>
conv.i4 <null>
blt IL_0183: ldloc.s V_32
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_14
ldloc.s V_14
ldstr run.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_15
ldloc.s V_15
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_16
ldloc.s V_16
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_17
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_02D6: ldloc.s V_10
ldloc.2 <null>
ldloc.s V_17
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_10
brfalse.s IL_034E: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldc.i4.s 9
newarr System.String
stloc.s V_36
ldloc.s V_36
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_36
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_36
ldc.i4.3 <null>
ldloc.s V_17
stelem.ref <null>
ldloc.s V_36
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_36
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_36
ldc.i4.7 <null>
ldloc.s V_11
stelem.ref <null>
ldloc.s V_36
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_36
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_035D: leave.s IL_036B
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_17
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_036B: leave.s IL_0379
ldloc.s V_16
brfalse.s IL_036A: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0379: ldloc.s V_10
ldloc.s V_15
brfalse.s IL_0378: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_10
brtrue IL_05A5: ldloc.s V_24
ldnull <null>
stloc.s V_18
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_19
ldloc.s V_8
stloc.s V_20
br IL_0564: ldloc.s V_20
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_21
ldloc.s V_21
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_0531: ldloc.s V_18
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_0531: ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
ldloca.s V_22
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_0531: ldloc.s V_18
ldloc.s V_18
brfalse.s IL_03E6: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0422: ldloc.s V_21
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0463: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0490: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_04D1: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_04FB: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_18
brfalse.s IL_054D: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_20
ldc.i4.1 <null>
add <null>
stloc.s V_20
ldloc.s V_20
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0398: ldloc.s V_19
ldloc.s V_18
brfalse.s IL_0581: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_5
ldloc.s V_7
ldnull <null>
ldloc.s V_28
brtrue.s IL_05C4: ldloc.s V_28
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__4(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_28
ldloc.s V_28
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_05E5: ldloc.s V_24
ldloc.s V_29
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_05CD: ldloc.0
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_0627: leave.s IL_063F
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_063F: ldloc.s V_4
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
brfalse.s IL_063E: endfinally
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_0654: leave.s IL_0670
ldloc.s V_4
brfalse.s IL_0653: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0670: ldloc.1
stloc.s V_25
ldstr An exception occured: 
call System.Void System.Console::Write(System.String)
ldloc.s V_25
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0670: ldloc.1
ldloc.1 <null>
brfalse.s IL_0683: ldloc.0
ldstr Hit any key to exit...
call System.Void System.Console::WriteLine(System.String)
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_30
ret <null>
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
3f924a568b81cddd3f7fdbcc19721edf
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
run.ps1
Malicious
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
3f924a568b81cddd3f7fdbcc19721edf › .Net Resources › run.ps1
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
3f924a568b81cddd3f7fdbcc19721edf › .Net Resources › run.ps1
URL in PowerShell #2 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
3f924a568b81cddd3f7fdbcc19721edf › .Net Resources › run.ps1
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙