Malicious
Malicious

3f924a568b81cddd3f7fdbcc19721edf

Share on LinkedIn
Print
PE Executable
MD5: 3f924a568b81cddd3f7fdbcc19721edf
Size: 25.6 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 3f924a568b81cddd3f7fdbcc19721edf
Sha1 fe41aa1fce4a41a11da253af51497ed86774fefb
Sha256 5f8208c4790ca7b7aa199cf9ae09933bef089e0f86df853b17b59c14e7aa3fab
Sha384 93759177ccf80f6c74a6e0665852a78e5764038e90e38359416f795c1221568c5510166dd7f21c1fb0aba022bb80487e
Sha512 51a2ca17fc28da807b93ccd48e2cca811c2fb189beb66c857428f7801c768b66fc91399669d7a63154a1a63243184de592aa8699ee71be740fc96a55b49b4ba4
SSDeep 384:pxysR3YvF6Ykd4dQ9RjQfTW4gCwL1WCb+Pi5kyiNVj+n2c:pwLndQ9dwIv1WCbJINQ2c
TLSH A3B23A897A98C62DD67F4B7C71F307200372E306512AEF85ADC85DAE6DA732408217DB
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
3f924a568b81cddd3f7fdbcc19721edf
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
run.ps1
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:ps1~T1027~T1059.001~T1105
Shape pe:exe>scr:ps1
malicious 2 nodes
Config. Field Value
URL in PowerShell #1 http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 http:/huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
install.exe
Full Name
install.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
install.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
install
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
77
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
583
Info
PE Detect: PeReader OK (file layout)
Main IL 
ldnull <null>
stloc.s V_26
ldnull <null>
stloc.s V_27
ldnull <null>
stloc.s V_28
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::.ctor()
stloc.s V_29
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_29
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.0 <null>
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_29
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
ldloc.s V_4
callvirt System.Management.Automation.Runspaces.SessionStateProxy System.Management.Automation.Runspaces.Runspace::get_SessionStateProxy()
ldstr ScriptRoot
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_31
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.Void System.Management.Automation.Runspaces.SessionStateProxy::SetVariable(System.String,System.Object)
ldnull <null>
stloc.s V_23
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::.ctor()
stloc.s V_24
ldloc.s V_24
ldloc.s V_29
stfld ModuleNameSpace.MainApp/<>c__DisplayClass8 ModuleNameSpace.MainApp/<>c__DisplayClassb::CS$<>8__locals9
ldloc.s V_24
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_23
brtrue.s IL_00D4: ldloc.s V_23
ldloc.s V_24
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::<Main>b__0(System.Object,System.ConsoleCancelEventArgs)
newobj System.Void System.ConsoleCancelEventHandler::.ctor(System.Object,System.IntPtr)
stloc.s V_23
ldloc.s V_23
call System.Void System.Console::add_CancelKeyPress(System.ConsoleCancelEventHandler)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_26
brtrue.s IL_010D: ldloc.s V_26
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__2(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_5
call System.Boolean System.Console::get_IsInputRedirected()
brfalse.s IL_013E: ldloc.s V_5
ldstr 
stloc.s V_6
br.s IL_0134: call System.String System.Console::ReadLine()
ldloc.s V_5
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_6
brtrue.s IL_012B: ldloc.s V_5
ldloc.s V_5
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_7
ldloc.s V_7
ldloc.s V_27
brtrue.s IL_0161: ldloc.s V_27
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__3(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_27
ldloc.s V_27
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_8
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldstr 
stloc.s V_11
ldarg.0 <null>
stloc.s V_32
ldc.i4.0 <null>
stloc.s V_33
br IL_0287: ldloc.s V_33
ldloc.s V_32
ldloc.s V_33
ldelem.ref <null>
stloc.s V_12
ldloc.s V_12
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01A0: ldloc.s V_12
ldc.i4.1 <null>
stloc.1 <null>
br IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_0202: ldloc.s V_12
ldloc.s V_12
ldc.i4.1 <null>
newarr System.String
stloc.s V_34
ldloc.s V_34
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_34
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_13
ldloc.s V_13
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_01E6: ldloc.s V_13
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.Void System.Console::WriteLine(System.String)
ldc.i4.1 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_13
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_35
ldloc.s V_35
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_35
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0219: ldloc.s V_12
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_8
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_12
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_022D: ldloc.s V_10
ldc.i4.1 <null>
stloc.s V_10
br.s IL_027B: ldloc.s V_9
ldloc.s V_10
brfalse.s IL_0264: ldloc.s V_12
ldloc.s V_12
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
ldloc.s V_12
stloc.s V_11
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_9
ldloc.s V_33
ldc.i4.1 <null>
add <null>
stloc.s V_33
ldloc.s V_33
ldloc.s V_32
ldlen <null>
conv.i4 <null>
blt IL_0183: ldloc.s V_32
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_14
ldloc.s V_14
ldstr run.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_15
ldloc.s V_15
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_16
ldloc.s V_16
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_17
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_02D6: ldloc.s V_10
ldloc.2 <null>
ldloc.s V_17
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_10
brfalse.s IL_034E: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldc.i4.s 9
newarr System.String
stloc.s V_36
ldloc.s V_36
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_36
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_36
ldc.i4.3 <null>
ldloc.s V_17
stelem.ref <null>
ldloc.s V_36
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_36
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_36
ldc.i4.7 <null>
ldloc.s V_11
stelem.ref <null>
ldloc.s V_36
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_36
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_035D: leave.s IL_036B
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_17
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_036B: leave.s IL_0379
ldloc.s V_16
brfalse.s IL_036A: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0379: ldloc.s V_10
ldloc.s V_15
brfalse.s IL_0378: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_10
brtrue IL_05A5: ldloc.s V_24
ldnull <null>
stloc.s V_18
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_19
ldloc.s V_8
stloc.s V_20
br IL_0564: ldloc.s V_20
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_21
ldloc.s V_21
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_0531: ldloc.s V_18
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_0531: ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
ldloca.s V_22
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_0531: ldloc.s V_18
ldloc.s V_18
brfalse.s IL_03E6: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0422: ldloc.s V_21
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0463: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0490: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_04D1: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_04FB: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_18
brfalse.s IL_054D: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_20
ldc.i4.1 <null>
add <null>
stloc.s V_20
ldloc.s V_20
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0398: ldloc.s V_19
ldloc.s V_18
brfalse.s IL_0581: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_5
ldloc.s V_7
ldnull <null>
ldloc.s V_28
brtrue.s IL_05C4: ldloc.s V_28
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__4(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_28
ldloc.s V_28
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_05E5: ldloc.s V_24
ldloc.s V_29
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_05CD: ldloc.0
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_0627: leave.s IL_063F
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_063F: ldloc.s V_4
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
brfalse.s IL_063E: endfinally
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_0654: leave.s IL_0670
ldloc.s V_4
brfalse.s IL_0653: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0670: ldloc.1
stloc.s V_25
ldstr An exception occured: 
call System.Void System.Console::Write(System.String)
ldloc.s V_25
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0670: ldloc.1
ldloc.1 <null>
brfalse.s IL_0683: ldloc.0
ldstr Hit any key to exit...
call System.Void System.Console::WriteLine(System.String)
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_30
ret <null>
Module Name
install.exe
Full Name
install.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
install.exe
Scope Type
ModuleDef
Kind
Console
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
install
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
77
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
583
Main IL 
ldnull <null>
stloc.s V_26
ldnull <null>
stloc.s V_27
ldnull <null>
stloc.s V_28
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::.ctor()
stloc.s V_29
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_29
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.0 <null>
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_29
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
ldloc.s V_4
callvirt System.Management.Automation.Runspaces.SessionStateProxy System.Management.Automation.Runspaces.Runspace::get_SessionStateProxy()
ldstr ScriptRoot
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_BaseDirectory()
ldc.i4.1 <null>
newarr System.Char
stloc.s V_31
ldloc.s V_31
ldc.i4.0 <null>
ldc.i4.s 92
stelem.i2 <null>
ldloc.s V_31
callvirt System.String System.String::TrimEnd(System.Char[])
callvirt System.Void System.Management.Automation.Runspaces.SessionStateProxy::SetVariable(System.String,System.Object)
ldnull <null>
stloc.s V_23
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::.ctor()
stloc.s V_24
ldloc.s V_24
ldloc.s V_29
stfld ModuleNameSpace.MainApp/<>c__DisplayClass8 ModuleNameSpace.MainApp/<>c__DisplayClassb::CS$<>8__locals9
ldloc.s V_24
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_23
brtrue.s IL_00D4: ldloc.s V_23
ldloc.s V_24
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClassb::<Main>b__0(System.Object,System.ConsoleCancelEventArgs)
newobj System.Void System.ConsoleCancelEventHandler::.ctor(System.Object,System.IntPtr)
stloc.s V_23
ldloc.s V_23
call System.Void System.Console::add_CancelKeyPress(System.ConsoleCancelEventHandler)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_26
brtrue.s IL_010D: ldloc.s V_26
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__2(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_5
call System.Boolean System.Console::get_IsInputRedirected()
brfalse.s IL_013E: ldloc.s V_5
ldstr 
stloc.s V_6
br.s IL_0134: call System.String System.Console::ReadLine()
ldloc.s V_5
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_6
brtrue.s IL_012B: ldloc.s V_5
ldloc.s V_5
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_7
ldloc.s V_7
ldloc.s V_27
brtrue.s IL_0161: ldloc.s V_27
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__3(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_27
ldloc.s V_27
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_8
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldstr 
stloc.s V_11
ldarg.0 <null>
stloc.s V_32
ldc.i4.0 <null>
stloc.s V_33
br IL_0287: ldloc.s V_33
ldloc.s V_32
ldloc.s V_33
ldelem.ref <null>
stloc.s V_12
ldloc.s V_12
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01A0: ldloc.s V_12
ldc.i4.1 <null>
stloc.1 <null>
br IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_0202: ldloc.s V_12
ldloc.s V_12
ldc.i4.1 <null>
newarr System.String
stloc.s V_34
ldloc.s V_34
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_34
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_13
ldloc.s V_13
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_01E6: ldloc.s V_13
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.Void System.Console::WriteLine(System.String)
ldc.i4.1 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_13
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_35
ldloc.s V_35
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_35
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0219: ldloc.s V_12
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_8
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_12
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_022D: ldloc.s V_10
ldc.i4.1 <null>
stloc.s V_10
br.s IL_027B: ldloc.s V_9
ldloc.s V_10
brfalse.s IL_0264: ldloc.s V_12
ldloc.s V_12
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_025E: ldloc.s V_12
ldloc.s V_12
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
ldloc.s V_12
stloc.s V_11
br.s IL_027B: ldloc.s V_9
ldloc.s V_12
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_027B: ldloc.s V_9
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0292: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_9
ldc.i4.1 <null>
add <null>
stloc.s V_9
ldloc.s V_33
ldc.i4.1 <null>
add <null>
stloc.s V_33
ldloc.s V_33
ldloc.s V_32
ldlen <null>
conv.i4 <null>
blt IL_0183: ldloc.s V_32
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_14
ldloc.s V_14
ldstr run.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_15
ldloc.s V_15
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_16
ldloc.s V_16
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_17
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_02D6: ldloc.s V_10
ldloc.2 <null>
ldloc.s V_17
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_30
leave IL_068A: ldloc.s V_30
ldloc.s V_10
brfalse.s IL_034E: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldc.i4.s 9
newarr System.String
stloc.s V_36
ldloc.s V_36
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_36
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_36
ldc.i4.3 <null>
ldloc.s V_17
stelem.ref <null>
ldloc.s V_36
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_36
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_36
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_36
ldc.i4.7 <null>
ldloc.s V_11
stelem.ref <null>
ldloc.s V_36
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_36
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_035D: leave.s IL_036B
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_17
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_036B: leave.s IL_0379
ldloc.s V_16
brfalse.s IL_036A: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0379: ldloc.s V_10
ldloc.s V_15
brfalse.s IL_0378: endfinally
ldloc.s V_15
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_10
brtrue IL_05A5: ldloc.s V_24
ldnull <null>
stloc.s V_18
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_19
ldloc.s V_8
stloc.s V_20
br IL_0564: ldloc.s V_20
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_21
ldloc.s V_21
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_0531: ldloc.s V_18
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_0531: ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
ldloca.s V_22
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_0531: ldloc.s V_18
ldloc.s V_18
brfalse.s IL_03E6: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0422: ldloc.s V_21
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0463: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0490: ldloc.s V_21
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br IL_055E: ldloc.s V_20
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_04D1: ldloc.s V_24
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_04FB: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_21
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_18
brfalse.s IL_054D: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_18
br.s IL_055E: ldloc.s V_20
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldarg.0 <null>
ldloc.s V_20
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_20
ldc.i4.1 <null>
add <null>
stloc.s V_20
ldloc.s V_20
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0398: ldloc.s V_19
ldloc.s V_18
brfalse.s IL_0581: ldloc.s V_24
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
ldloc.s V_5
ldloc.s V_7
ldnull <null>
ldloc.s V_28
brtrue.s IL_05C4: ldloc.s V_28
ldloc.s V_29
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass8::<Main>b__4(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_28
ldloc.s V_28
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_05E5: ldloc.s V_24
ldloc.s V_29
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass8::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_05CD: ldloc.0
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_0627: leave.s IL_063F
ldloc.s V_29
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass8::ui
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_063F: ldloc.s V_4
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
brfalse.s IL_063E: endfinally
ldloc.s V_24
ldfld System.Management.Automation.PowerShell ModuleNameSpace.MainApp/<>c__DisplayClassb::posh
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_0654: leave.s IL_0670
ldloc.s V_4
brfalse.s IL_0653: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0670: ldloc.1
stloc.s V_25
ldstr An exception occured: 
call System.Void System.Console::Write(System.String)
ldloc.s V_25
callvirt System.String System.Exception::get_Message()
call System.Void System.Console::WriteLine(System.String)
leave.s IL_0670: ldloc.1
ldloc.1 <null>
brfalse.s IL_0683: ldloc.0
ldstr Hit any key to exit...
call System.Void System.Console::WriteLine(System.String)
call System.ConsoleKeyInfo System.Console::ReadKey()
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_30
ret <null>
Deobfuscated PowerShell UNKNWOWNmalicious
[Servihuhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #1 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
URL in PowerShell #2 URImalicious
http:/huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙