Malicious
Malicious

406f6190517a3f110332dd923f60640f

PE Executable
MD5: 406f6190517a3f110332dd923f60640f
Size: 36.35 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
Symbol Obfuscation Score Low
MD5 406f6190517a3f110332dd923f60640f
Sha1 493b02d3eb99b35fb3de7b7d61d3d03a08905919
Sha256 5995a8c818812bda6fe0d154da94c34a6a3619aa2797edbaea69c40b81f4639e
Sha384 483094b58a9a739f652bb9a50e58e45fdbf504d69661b6216e085113243b1f334370572668bd29794f8e7b8394939c1d
Sha512 81e8a03dd89951d4ea52ecfed32debd9462e89250c5d8ae1f108cd239be4fcd4c5af4461059357a8570d485abbbcf5a5f1e80c4c91970b7523d5c5d342181d01
SSDeep 768:5mQZqx1lYcTYbFyf8qLIRFQjnbaoXbYC10kos:50lYiLIRFQjRbPos
TLSH 79F23A487B98C12BDBAF0E7D75621A11167297521203CBD53ECC24EEFFA37058612B8B
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
406f6190517a3f110332dd923f60640f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
script.ps1
Malicious
STICH beta Structural Threat Infection Chain Hash

A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.

Structural branches: 2 STICH kept: 1secondary ignored: 1
bin 1

Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.

STICH Path = the fingerprint (canonical chain with techniques) STICH Shape = structure only Only determinant branches produce STICH Paths.
Path pe:exe>scr:ps1~T1027~T1059.001~T1105
Shape pe:exe>scr:ps1
malicious 2 nodes
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
script.exe
Full Name
script.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
script.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
script
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Info
PE Detect: PeReader OK (file layout)
Total Strings
94
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
545
Main IL 
ldnull <null>
stloc.s V_25
ldnull <null>
stloc.s V_26
ldnull <null>
stloc.s V_27
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::.ctor()
stloc.s V_28
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_28
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
ldloc.0 <null>
ldloc.s V_28
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_28
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_5
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_25
brtrue.s IL_00A6: ldloc.s V_25
ldloc.s V_28
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__0(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_25
ldloc.s V_25
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_6
call System.Boolean System.Console::get_IsInputRedirected()
brfalse.s IL_00D7: ldloc.s V_6
ldstr 
stloc.s V_7
br.s IL_00CD: call System.String System.Console::ReadLine()
ldloc.s V_6
ldloc.s V_7
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_7
brtrue.s IL_00C4: ldloc.s V_6
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_8
ldloc.s V_8
ldloc.s V_26
brtrue.s IL_00FA: ldloc.s V_26
ldloc.s V_28
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__1(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
ldstr 
stloc.s V_12
ldarg.0 <null>
stloc.s V_30
ldc.i4.0 <null>
stloc.s V_31
br IL_022E: ldloc.s V_31
ldloc.s V_30
ldloc.s V_31
ldelem.ref <null>
stloc.s V_13
ldloc.s V_13
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0139: ldloc.s V_13
ldc.i4.1 <null>
stloc.1 <null>
br IL_0222: ldloc.s V_10
ldloc.s V_13
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_01A9: ldloc.s V_13
ldloc.s V_13
ldc.i4.1 <null>
newarr System.String
stloc.s V_32
ldloc.s V_32
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_32
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_14
ldloc.s V_14
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_018D: ldloc.s V_14
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
stloc.s V_29
leave IL_05EF: ldloc.s V_29
ldloc.s V_14
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_33
ldloc.s V_33
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_33
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_0222: ldloc.s V_10
ldloc.s V_13
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01C0: ldloc.s V_13
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_9
br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_13
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01D4: ldloc.s V_11
ldc.i4.1 <null>
stloc.s V_11
br.s IL_0222: ldloc.s V_10
ldloc.s V_11
brfalse.s IL_020B: ldloc.s V_13
ldloc.s V_13
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_0205: ldloc.s V_13
ldloc.s V_13
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_0205: ldloc.s V_13
ldloc.s V_13
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0222: ldloc.s V_10
ldloc.s V_13
stloc.s V_12
br.s IL_0222: ldloc.s V_10
ldloc.s V_13
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0222: ldloc.s V_10
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_31
ldc.i4.1 <null>
add <null>
stloc.s V_31
ldloc.s V_31
ldloc.s V_30
ldlen <null>
conv.i4 <null>
blt IL_011C: ldloc.s V_30
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_15
ldloc.s V_15
ldstr script.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_17
ldloc.s V_17
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_18
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_027D: ldloc.s V_11
ldloc.2 <null>
ldloc.s V_18
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_29
leave IL_05EF: ldloc.s V_29
ldloc.s V_11
brfalse.s IL_02F0: ldloc.s V_5
ldloc.s V_5
ldc.i4.s 9
newarr System.String
stloc.s V_34
ldloc.s V_34
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_34
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_34
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_34
ldc.i4.3 <null>
ldloc.s V_18
stelem.ref <null>
ldloc.s V_34
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_34
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_34
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_34
ldc.i4.7 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_34
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_34
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_02FA: leave.s IL_0308
ldloc.s V_5
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_0308: leave.s IL_0316
ldloc.s V_17
brfalse.s IL_0307: endfinally
ldloc.s V_17
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0316: ldloc.s V_11
ldloc.s V_16
brfalse.s IL_0315: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_11
brtrue IL_0515: ldloc.s V_5
ldnull <null>
stloc.s V_19
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_20
ldloc.s V_9
stloc.s V_21
br IL_04E3: ldloc.s V_21
ldloc.s V_20
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_22
ldloc.s V_22
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_04BA: ldloc.s V_19
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_04BA: ldloc.s V_19
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
ldloca.s V_23
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_04BA: ldloc.s V_19
ldloc.s V_19
brfalse.s IL_037E: ldloc.s V_22
ldloc.s V_5
ldloc.s V_19
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_03BA: ldloc.s V_22
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_19
br IL_04DD: ldloc.s V_21
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_03FB: ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0423: ldloc.s V_22
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br IL_04DD: ldloc.s V_21
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0464: ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0489: ldloc.s V_5
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04DD: ldloc.s V_21
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04DD: ldloc.s V_21
ldloc.s V_19
brfalse.s IL_04D1: ldloc.s V_5
ldloc.s V_5
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04DD: ldloc.s V_21
ldloc.s V_5
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0335: ldloc.s V_20
ldloc.s V_19
brfalse.s IL_04FB: ldloc.s V_5
ldloc.s V_5
ldloc.s V_19
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_5
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_5
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_5
ldloc.s V_6
ldloc.s V_8
ldnull <null>
ldloc.s V_27
brtrue.s IL_052F: ldloc.s V_27
ldloc.s V_28
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__2(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_27
ldloc.s V_27
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_0550: ldloc.s V_5
ldloc.s V_28
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_0538: ldloc.0
ldloc.s V_5
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_5
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_0583: leave.s IL_0591
ldloc.s V_28
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
ldloc.s V_5
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_0591: ldloc.s V_4
ldloc.s V_5
brfalse.s IL_0590: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_05A6: leave.s IL_05D0
ldloc.s V_4
brfalse.s IL_05A5: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_05D0: ldloc.1
stloc.s V_24
ldstr An exception occured: 
ldloc.s V_24
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_05D0: ldloc.1
ldloc.1 <null>
brfalse.s IL_05E8: ldloc.0
ldstr Click OK to exit...
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_29
ret <null>
Module Name
script.exe
Full Name
script.exe
EntryPoint
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Scope Name
script.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
script
Assembly Version
0.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
94
Main Method
System.Int32 ModuleNameSpace.MainApp::Main(System.String[])
Main IL Instruction Count
545
Main IL 
ldnull <null>
stloc.s V_25
ldnull <null>
stloc.s V_26
ldnull <null>
stloc.s V_27
newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::.ctor()
stloc.s V_28
call System.Void System.Windows.Forms.Application::EnableVisualStyles()
newobj System.Void ModuleNameSpace.MainApp::.ctor()
stloc.0 <null>
ldc.i4.0 <null>
stloc.1 <null>
ldsfld System.String System.String::Empty
stloc.2 <null>
ldloc.s V_28
newobj System.Void ModuleNameSpace.MainModuleUI::.ctor()
stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
ldloc.0 <null>
ldloc.s V_28
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI)
stloc.3 <null>
ldloc.s V_28
ldc.i4.0 <null>
newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean)
stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre
call System.AppDomain System.AppDomain::get_CurrentDomain()
ldnull <null>
ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs)
newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr)
callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler)
ldloc.3 <null>
call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost)
stloc.s V_4
ldloc.s V_4
ldc.i4.0 <null>
callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState)
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open()
call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create()
stloc.s V_5
ldloc.s V_5
ldloc.s V_4
callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace)
ldloc.s V_5
callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams()
callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error()
ldloc.s V_25
brtrue.s IL_00A6: ldloc.s V_25
ldloc.s V_28
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__0(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_25
ldloc.s V_25
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor()
stloc.s V_6
call System.Boolean System.Console::get_IsInputRedirected()
brfalse.s IL_00D7: ldloc.s V_6
ldstr 
stloc.s V_7
br.s IL_00CD: call System.String System.Console::ReadLine()
ldloc.s V_6
ldloc.s V_7
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String)
call System.String System.Console::ReadLine()
dup <null>
stloc.s V_7
brtrue.s IL_00C4: ldloc.s V_6
ldloc.s V_6
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete()
newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor()
stloc.s V_8
ldloc.s V_8
ldloc.s V_26
brtrue.s IL_00FA: ldloc.s V_26
ldloc.s V_28
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__1(System.Object,System.Management.Automation.DataAddedEventArgs)
newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr)
stloc.s V_26
ldloc.s V_26
callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>)
ldc.i4.0 <null>
stloc.s V_9
ldc.i4.0 <null>
stloc.s V_10
ldc.i4.0 <null>
stloc.s V_11
ldstr 
stloc.s V_12
ldarg.0 <null>
stloc.s V_30
ldc.i4.0 <null>
stloc.s V_31
br IL_022E: ldloc.s V_31
ldloc.s V_30
ldloc.s V_31
ldelem.ref <null>
stloc.s V_13
ldloc.s V_13
ldstr -wait
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0139: ldloc.s V_13
ldc.i4.1 <null>
stloc.1 <null>
br IL_0222: ldloc.s V_10
ldloc.s V_13
ldstr -extract
ldc.i4.3 <null>
callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison)
brfalse.s IL_01A9: ldloc.s V_13
ldloc.s V_13
ldc.i4.1 <null>
newarr System.String
stloc.s V_32
ldloc.s V_32
ldc.i4.0 <null>
ldstr :
stelem.ref <null>
ldloc.s V_32
ldc.i4.2 <null>
ldc.i4.1 <null>
callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions)
stloc.s V_14
ldloc.s V_14
ldlen <null>
conv.i4 <null>
ldc.i4.2 <null>
beq.s IL_018D: ldloc.s V_14
ldstr If you specify the -extract option you need to add a file for extraction in this way
   -extract:"<filename>"
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
ldc.i4.1 <null>
stloc.s V_29
leave IL_05EF: ldloc.s V_29
ldloc.s V_14
ldc.i4.1 <null>
ldelem.ref <null>
ldc.i4.1 <null>
newarr System.Char
stloc.s V_33
ldloc.s V_33
ldc.i4.0 <null>
ldc.i4.s 34
stelem.i2 <null>
ldloc.s V_33
callvirt System.String System.String::Trim(System.Char[])
stloc.2 <null>
br.s IL_0222: ldloc.s V_10
ldloc.s V_13
ldstr -end
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01C0: ldloc.s V_13
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_9
br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_13
ldstr -?
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_01D4: ldloc.s V_11
ldc.i4.1 <null>
stloc.s V_11
br.s IL_0222: ldloc.s V_10
ldloc.s V_11
brfalse.s IL_020B: ldloc.s V_13
ldloc.s V_13
ldstr -detailed
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_0205: ldloc.s V_13
ldloc.s V_13
ldstr -examples
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brfalse.s IL_0205: ldloc.s V_13
ldloc.s V_13
ldstr -full
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0222: ldloc.s V_10
ldloc.s V_13
stloc.s V_12
br.s IL_0222: ldloc.s V_10
ldloc.s V_13
ldstr -debug
ldc.i4.1 <null>
call System.Int32 System.String::Compare(System.String,System.String,System.Boolean)
brtrue.s IL_0222: ldloc.s V_10
call System.Boolean System.Diagnostics.Debugger::Launch()
pop <null>
br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
ldloc.s V_10
ldc.i4.1 <null>
add <null>
stloc.s V_10
ldloc.s V_31
ldc.i4.1 <null>
add <null>
stloc.s V_31
ldloc.s V_31
ldloc.s V_30
ldlen <null>
conv.i4 <null>
blt IL_011C: ldloc.s V_30
call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly()
stloc.s V_15
ldloc.s V_15
ldstr script.ps1
callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String)
stloc.s V_16
ldloc.s V_16
call System.Text.Encoding System.Text.Encoding::get_UTF8()
newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding)
stloc.s V_17
ldloc.s V_17
callvirt System.String System.IO.TextReader::ReadToEnd()
stloc.s V_18
ldloc.2 <null>
call System.Boolean System.String::IsNullOrEmpty(System.String)
brtrue.s IL_027D: ldloc.s V_11
ldloc.2 <null>
ldloc.s V_18
call System.Void System.IO.File::WriteAllText(System.String,System.String)
ldc.i4.0 <null>
stloc.s V_29
leave IL_05EF: ldloc.s V_29
ldloc.s V_11
brfalse.s IL_02F0: ldloc.s V_5
ldloc.s V_5
ldc.i4.s 9
newarr System.String
stloc.s V_34
ldloc.s V_34
ldc.i4.0 <null>
ldstr function 
stelem.ref <null>
ldloc.s V_34
ldc.i4.1 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_34
ldc.i4.2 <null>
ldstr {
stelem.ref <null>
ldloc.s V_34
ldc.i4.3 <null>
ldloc.s V_18
stelem.ref <null>
ldloc.s V_34
ldc.i4.4 <null>
ldstr }; Get-Help 
stelem.ref <null>
ldloc.s V_34
ldc.i4.5 <null>
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
stelem.ref <null>
ldloc.s V_34
ldc.i4.6 <null>
ldstr  
stelem.ref <null>
ldloc.s V_34
ldc.i4.7 <null>
ldloc.s V_12
stelem.ref <null>
ldloc.s V_34
ldc.i4.8 <null>
ldstr  | Out-String
stelem.ref <null>
ldloc.s V_34
call System.String System.String::Concat(System.String[])
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
br.s IL_02FA: leave.s IL_0308
ldloc.s V_5
ldloc.s V_18
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String)
pop <null>
leave.s IL_0308: leave.s IL_0316
ldloc.s V_17
brfalse.s IL_0307: endfinally
ldloc.s V_17
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_0316: ldloc.s V_11
ldloc.s V_16
brfalse.s IL_0315: endfinally
ldloc.s V_16
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_11
brtrue IL_0515: ldloc.s V_5
ldnull <null>
stloc.s V_19
ldstr ^-([^: ]+)[ :]?([^:]*)$
newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String)
stloc.s V_20
ldloc.s V_9
stloc.s V_21
br IL_04E3: ldloc.s V_21
ldloc.s V_20
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String)
stloc.s V_22
ldloc.s V_22
callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success()
brfalse IL_04BA: ldloc.s V_19
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count()
ldc.i4.3 <null>
bne.un IL_04BA: ldloc.s V_19
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
ldloca.s V_23
call System.Boolean System.Double::TryParse(System.String,System.Double&)
brtrue IL_04BA: ldloc.s V_19
ldloc.s V_19
brfalse.s IL_037E: ldloc.s V_22
ldloc.s V_5
ldloc.s V_19
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::Trim()
ldstr 
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_03BA: ldloc.s V_22
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
stloc.s V_19
br IL_04DD: ldloc.s V_21
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr True
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_03FB: ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $TRUE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0423: ldloc.s V_22
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.1 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br IL_04DD: ldloc.s V_21
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldstr False
call System.Boolean System.String::op_Equality(System.String,System.String)
brtrue.s IL_0464: ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.String System.String::ToUpper()
ldstr $FALSE
call System.Boolean System.String::op_Equality(System.String,System.String)
brfalse.s IL_0489: ldloc.s V_5
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldc.i4.0 <null>
box System.Boolean
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04DD: ldloc.s V_21
ldloc.s V_5
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.1 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
ldloc.s V_22
callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups()
ldc.i4.2 <null>
callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32)
callvirt System.String System.Text.RegularExpressions.Capture::get_Value()
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04DD: ldloc.s V_21
ldloc.s V_19
brfalse.s IL_04D1: ldloc.s V_5
ldloc.s V_5
ldloc.s V_19
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object)
pop <null>
ldnull <null>
stloc.s V_19
br.s IL_04DD: ldloc.s V_21
ldloc.s V_5
ldarg.0 <null>
ldloc.s V_21
ldelem.ref <null>
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object)
pop <null>
ldloc.s V_21
ldc.i4.1 <null>
add <null>
stloc.s V_21
ldloc.s V_21
ldarg.0 <null>
ldlen <null>
conv.i4 <null>
blt IL_0335: ldloc.s V_20
ldloc.s V_19
brfalse.s IL_04FB: ldloc.s V_5
ldloc.s V_5
ldloc.s V_19
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_5
ldstr Out-String
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String)
pop <null>
ldloc.s V_5
ldstr Stream
callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String)
pop <null>
ldloc.s V_5
ldloc.s V_6
ldloc.s V_8
ldnull <null>
ldloc.s V_27
brtrue.s IL_052F: ldloc.s V_27
ldloc.s V_28
ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__2(System.IAsyncResult)
newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr)
stloc.s V_27
ldloc.s V_27
ldnull <null>
callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object)
pop <null>
ldloc.0 <null>
callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit()
brtrue.s IL_0550: ldloc.s V_5
ldloc.s V_28
ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre
ldc.i4.s 100
callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32)
brfalse.s IL_0538: ldloc.0
ldloc.s V_5
callvirt System.Void System.Management.Automation.PowerShell::Stop()
ldloc.s V_5
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State()
ldc.i4.5 <null>
bne.un.s IL_0583: leave.s IL_0591
ldloc.s V_28
ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui
ldloc.s V_5
callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo()
callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason()
callvirt System.String System.Exception::get_Message()
callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String)
leave.s IL_0591: ldloc.s V_4
ldloc.s V_5
brfalse.s IL_0590: endfinally
ldloc.s V_5
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
ldloc.s V_4
callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close()
leave.s IL_05A6: leave.s IL_05D0
ldloc.s V_4
brfalse.s IL_05A5: endfinally
ldloc.s V_4
callvirt System.Void System.IDisposable::Dispose()
endfinally <null>
leave.s IL_05D0: ldloc.1
stloc.s V_24
ldstr An exception occured: 
ldloc.s V_24
callvirt System.String System.Exception::get_Message()
call System.String System.String::Concat(System.String,System.String)
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
ldc.i4.0 <null>
ldc.i4.s 16
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon)
pop <null>
leave.s IL_05D0: ldloc.1
ldloc.1 <null>
brfalse.s IL_05E8: ldloc.0
ldstr Click OK to exit...
call System.AppDomain System.AppDomain::get_CurrentDomain()
callvirt System.String System.AppDomain::get_FriendlyName()
call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String)
pop <null>
ldloc.0 <null>
callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode()
ret <null>
ldloc.s V_29
ret <null>
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
Deobfuscated PowerShell UNKNWOWNmalicious
param(huhuhuhuhuhuhuhuhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
406f6190517a3f110332dd923f60640f
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
script.ps1
Malicious
Config. Field Value
URL in PowerShell #1 https:huhuhuhuhuhuhuhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
URL in PowerShell #1 URImalicious
https:huhuhuhuhuhuhuhuhuhuhu
406f6190517a3f110332dd923f60640f › .Net Resources › script.ps1
Deobfuscated PowerShell UNKNWOWNmalicious
param(huhuhuhuhuhuhuhuhuhuhu
406f6190517a3f110332dd923f60640f › .Net Resources › script.ps1 › [Deobfuscated PS]
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
You must be signed in to view YARA rules.
An error has occurred. This application may no longer respond until reloaded. Reload 🗙