Malicious
Malicious

afd62f9f16918c40a5fb392ce298179f

PE Executable
|
MD5: afd62f9f16918c40a5fb392ce298179f
|
Size: 73.3 KB
|
application/x-msdownload

Executable
PE (Portable Executable)
Win 32 Exe
x86
.Net
SOS: 0.08
DeObfuscated
PowerShell

Print
General
Structural Analysis
Config.0
Yara Rules91
Sync
Community
Infection Chain
Summary by MalvaGPT
Characteristics

Symbol Ofbuscation Score

Very low

Hash
Hash Value
MD5
afd62f9f16918c40a5fb392ce298179f
Sha1
2ba1ec5e2a6e67b9de1051e9501a6c19fff37415
Sha256
83354f7b5ee916cdecb948da2c02b1f76c3465cb341e50c5397805c16c6084fa
Sha384
14e6afc10df0727f636b061806c54756fe49192f2da15f34bdf9dc7c2a5275d7b2591f33d2a45cfb9574316666d53dec
Sha512
0651e5b9a702670b66025e47d712a8d7366dd9c9eb38ece70b6f66c9c185103edfc1ae201128e0c716c15f19870922bc863dcb224e977427c3e8b996ea2c7136
SSDeep
1536:kOpwLVUQh/0holIHRPgX+OswX3eye5IjbOpjhGbzGRqWISl9CIQkUSDRBL78j:k4wL6Qh/0holIHWn33VSRsba3Io9C2Ub
TLSH
2E63BF682B28C52FDA6F4F7C71A24962467193925802CB8A3DCC59DFAF937000F2579F

PeID

.NET executable
Microsoft Visual C# / Basic .NET
Microsoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL
Microsoft Visual C# v7.0 / Basic .NET
Microsoft Visual Studio .NET
File Structure
afd62f9f16918c40a5fb392ce298179f
Executable
PE (Portable Executable)
Win 32 Exe
x86
.Net
SOS: 0.08
DeObfuscated
PowerShell
Malicious
Structure
DosHeader
PE Header
Optional Header (x86)
Section Headers
.text
.rsrc
.reloc
Resources
RT_ICON
ID:0002
ID:0
ID:0-preview.png
RT_GROUP_CURSOR4
ID:7F00
ID:0
RT_VERSION
ID:0001
ID:0
RT_MANIFEST
ID:0001
ID:0
.Net Resources
Malicious
protected_modified_stub_sihost_20250701_131707_20250701_131707.ps1
PowerShell
DeObfuscated
Contains Base64 Block
Base64 Block
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Contains Base64 Block
Base64 Block
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Contains Base64 Block
Base64 Block
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Contains Base64 Block
Base64 Block
Malicious
[Deobfuscated PS]
DeObfuscated
PowerShell
Contains Base64 Block
Base64 Block
Malicious
[Base64-Block]
Base64 Block
Informations
Name
Value
Module Name

sihost.exe

Full Name

sihost.exe

EntryPoint

System.Int32 ModuleNameSpace.MainApp::Main(System.String[])

Scope Name

sihost.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

sihost

Assembly Version

3.6.5.2774

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

94

Main Method

System.Int32 ModuleNameSpace.MainApp::Main(System.String[])

Main IL Instruction Count

545

Main IL

ldnull <null> stloc.s V_25 ldnull <null> stloc.s V_26 ldnull <null> stloc.s V_27 newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::.ctor() stloc.s V_28 call System.Void System.Windows.Forms.Application::EnableVisualStyles() newobj System.Void ModuleNameSpace.MainApp::.ctor() stloc.0 <null> ldc.i4.0 <null> stloc.1 <null> ldsfld System.String System.String::Empty stloc.2 <null> ldloc.s V_28 newobj System.Void ModuleNameSpace.MainModuleUI::.ctor() stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui ldloc.0 <null> ldloc.s V_28 ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI) stloc.3 <null> ldloc.s V_28 ldc.i4.0 <null> newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean) stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) ldloc.3 <null> call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost) stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState) ldloc.s V_4 callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open() call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create() stloc.s V_5 ldloc.s V_5 ldloc.s V_4 callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace) ldloc.s V_5 callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams() callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error() ldloc.s V_25 brtrue.s IL_00A6: ldloc.s V_25 ldloc.s V_28 ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__0(System.Object,System.Management.Automation.DataAddedEventArgs) newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr) stloc.s V_25 ldloc.s V_25 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>) newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor() stloc.s V_6 call System.Boolean ModuleNameSpace.Console_Info::IsInputRedirected() brfalse.s IL_00D7: ldloc.s V_6 ldstr stloc.s V_7 br.s IL_00CD: call System.String System.Console::ReadLine() ldloc.s V_6 ldloc.s V_7 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String) call System.String System.Console::ReadLine() dup <null> stloc.s V_7 brtrue.s IL_00C4: ldloc.s V_6 ldloc.s V_6 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete() newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor() stloc.s V_8 ldloc.s V_8 ldloc.s V_26 brtrue.s IL_00FA: ldloc.s V_26 ldloc.s V_28 ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__1(System.Object,System.Management.Automation.DataAddedEventArgs) newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr) stloc.s V_26 ldloc.s V_26 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>) ldc.i4.0 <null> stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 ldc.i4.0 <null> stloc.s V_11 ldstr stloc.s V_12 ldarg.0 <null> stloc.s V_30 ldc.i4.0 <null> stloc.s V_31 br IL_022E: ldloc.s V_31 ldloc.s V_30 ldloc.s V_31 ldelem.ref <null> stloc.s V_13 ldloc.s V_13 ldstr -wait ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_0139: ldloc.s V_13 ldc.i4.1 <null> stloc.1 <null> br IL_0222: ldloc.s V_10 ldloc.s V_13 ldstr -extract ldc.i4.3 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brfalse.s IL_01A9: ldloc.s V_13 ldloc.s V_13 ldc.i4.1 <null> newarr System.String stloc.s V_32 ldloc.s V_32 ldc.i4.0 <null> ldstr : stelem.ref <null> ldloc.s V_32 ldc.i4.2 <null> ldc.i4.1 <null> callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions) stloc.s V_14 ldloc.s V_14 ldlen <null> conv.i4 <null> ldc.i4.2 <null> beq.s IL_018D: ldloc.s V_14 ldstr If you specify the -extract option you need to add a file for extraction in this way -extract:"<filename>" call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_29 leave IL_05EF: ldloc.s V_29 ldloc.s V_14 ldc.i4.1 <null> ldelem.ref <null> ldc.i4.1 <null> newarr System.Char stloc.s V_33 ldloc.s V_33 ldc.i4.0 <null> ldc.i4.s 34 stelem.i2 <null> ldloc.s V_33 callvirt System.String System.String::Trim(System.Char[]) stloc.2 <null> br.s IL_0222: ldloc.s V_10 ldloc.s V_13 ldstr -end ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_01C0: ldloc.s V_13 ldloc.s V_10 ldc.i4.1 <null> add <null> stloc.s V_9 br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_13 ldstr -? ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_01D4: ldloc.s V_11 ldc.i4.1 <null> stloc.s V_11 br.s IL_0222: ldloc.s V_10 ldloc.s V_11 brfalse.s IL_020B: ldloc.s V_13 ldloc.s V_13 ldstr -detailed ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brfalse.s IL_0205: ldloc.s V_13 ldloc.s V_13 ldstr -examples ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brfalse.s IL_0205: ldloc.s V_13 ldloc.s V_13 ldstr -full ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_0222: ldloc.s V_10 ldloc.s V_13 stloc.s V_12 br.s IL_0222: ldloc.s V_10 ldloc.s V_13 ldstr -debug ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_0222: ldloc.s V_10 call System.Boolean System.Diagnostics.Debugger::Launch() pop <null> br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_10 ldc.i4.1 <null> add <null> stloc.s V_10 ldloc.s V_31 ldc.i4.1 <null> add <null> stloc.s V_31 ldloc.s V_31 ldloc.s V_30 ldlen <null> conv.i4 <null> blt IL_011C: ldloc.s V_30 call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_15 ldloc.s V_15 ldstr protected_modified_stub_sihost_20250701_131707_20250701_131707.ps1 callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_16 ldloc.s V_16 call System.Text.Encoding System.Text.Encoding::get_UTF8() newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding) stloc.s V_17 ldloc.s V_17 callvirt System.String System.IO.TextReader::ReadToEnd() stloc.s V_18 ldloc.2 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue.s IL_027D: ldloc.s V_11 ldloc.2 <null> ldloc.s V_18 call System.Void System.IO.File::WriteAllText(System.String,System.String) ldc.i4.0 <null> stloc.s V_29 leave IL_05EF: ldloc.s V_29 ldloc.s V_11 brfalse.s IL_02F0: ldloc.s V_5 ldloc.s V_5 ldc.i4.s 9 newarr System.String stloc.s V_34 ldloc.s V_34 ldc.i4.0 <null> ldstr function stelem.ref <null> ldloc.s V_34 ldc.i4.1 <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() stelem.ref <null> ldloc.s V_34 ldc.i4.2 <null> ldstr { stelem.ref <null> ldloc.s V_34 ldc.i4.3 <null> ldloc.s V_18 stelem.ref <null> ldloc.s V_34 ldc.i4.4 <null> ldstr }; Get-Help stelem.ref <null> ldloc.s V_34 ldc.i4.5 <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() stelem.ref <null> ldloc.s V_34 ldc.i4.6 <null> ldstr stelem.ref <null> ldloc.s V_34 ldc.i4.7 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_34 ldc.i4.8 <null> ldstr | Out-String stelem.ref <null> ldloc.s V_34 call System.String System.String::Concat(System.String[]) callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String) pop <null> br.s IL_02FA: leave.s IL_0308 ldloc.s V_5 ldloc.s V_18 callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String) pop <null> leave.s IL_0308: leave.s IL_0316 ldloc.s V_17 brfalse.s IL_0307: endfinally ldloc.s V_17 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0316: ldloc.s V_11 ldloc.s V_16 brfalse.s IL_0315: endfinally ldloc.s V_16 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_11 brtrue IL_0515: ldloc.s V_5 ldnull <null> stloc.s V_19 ldstr ^-([^: ]+)[ :]?([^:]*)$ newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String) stloc.s V_20 ldloc.s V_9 stloc.s V_21 br IL_04E3: ldloc.s V_21 ldloc.s V_20 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String) stloc.s V_22 ldloc.s V_22 callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success() brfalse IL_04BA: ldloc.s V_19 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count() ldc.i4.3 <null> bne.un IL_04BA: ldloc.s V_19 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> ldloca.s V_23 call System.Boolean System.Double::TryParse(System.String,System.Double&) brtrue IL_04BA: ldloc.s V_19 ldloc.s V_19 brfalse.s IL_037E: ldloc.s V_22 ldloc.s V_5 ldloc.s V_19 callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String) pop <null> ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.String System.String::Trim() ldstr call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_03BA: ldloc.s V_22 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() stloc.s V_19 br IL_04DD: ldloc.s V_21 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldstr True call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_03FB: ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.String System.String::ToUpper() ldstr $TRUE call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_0423: ldloc.s V_22 ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldc.i4.1 <null> box System.Boolean callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br IL_04DD: ldloc.s V_21 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldstr False call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0464: ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.String System.String::ToUpper() ldstr $FALSE call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_0489: ldloc.s V_5 ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldc.i4.0 <null> box System.Boolean callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br.s IL_04DD: ldloc.s V_21 ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br.s IL_04DD: ldloc.s V_21 ldloc.s V_19 brfalse.s IL_04D1: ldloc.s V_5 ldloc.s V_5 ldloc.s V_19 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br.s IL_04DD: ldloc.s V_21 ldloc.s V_5 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object) pop <null> ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldarg.0 <null> ldlen <null> conv.i4 <null> blt IL_0335: ldloc.s V_20 ldloc.s V_19 brfalse.s IL_04FB: ldloc.s V_5 ldloc.s V_5 ldloc.s V_19 callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String) pop <null> ldloc.s V_5 ldstr Out-String callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String) pop <null> ldloc.s V_5 ldstr Stream callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String) pop <null> ldloc.s V_5 ldloc.s V_6 ldloc.s V_8 ldnull <null> ldloc.s V_27 brtrue.s IL_052F: ldloc.s V_27 ldloc.s V_28 ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__2(System.IAsyncResult) newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr) stloc.s V_27 ldloc.s V_27 ldnull <null> callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object) pop <null> ldloc.0 <null> callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit() brtrue.s IL_0550: ldloc.s V_5 ldloc.s V_28 ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre ldc.i4.s 100 callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32) brfalse.s IL_0538: ldloc.0 ldloc.s V_5 callvirt System.Void System.Management.Automation.PowerShell::Stop() ldloc.s V_5 callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo() callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State() ldc.i4.5 <null> bne.un.s IL_0583: leave.s IL_0591 ldloc.s V_28 ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui ldloc.s V_5 callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo() callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason() callvirt System.String System.Exception::get_Message() callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String) leave.s IL_0591: ldloc.s V_4 ldloc.s V_5 brfalse.s IL_0590: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close() leave.s IL_05A6: leave.s IL_05D0 ldloc.s V_4 brfalse.s IL_05A5: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_05D0: ldloc.1 stloc.s V_24 ldstr An exception occured: ldloc.s V_24 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_05D0: ldloc.1 ldloc.1 <null> brfalse.s IL_05E8: ldloc.0 ldstr Click OK to exit... call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldloc.0 <null> callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode() ret <null> ldloc.s V_29 ret <null>

Module Name

sihost.exe

Full Name

sihost.exe

EntryPoint

System.Int32 ModuleNameSpace.MainApp::Main(System.String[])

Scope Name

sihost.exe

Scope Type

ModuleDef

Kind

Windows

Runtime Version

v4.0.30319

Tables Header Version

512

WinMD Version

<null>

Assembly Name

sihost

Assembly Version

3.6.5.2774

Assembly Culture

<null>

Has PublicKey

False

PublicKey Token

<null>

Target Framework

<null>

Total Strings

94

Main Method

System.Int32 ModuleNameSpace.MainApp::Main(System.String[])

Main IL Instruction Count

545

Main IL

ldnull <null> stloc.s V_25 ldnull <null> stloc.s V_26 ldnull <null> stloc.s V_27 newobj System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::.ctor() stloc.s V_28 call System.Void System.Windows.Forms.Application::EnableVisualStyles() newobj System.Void ModuleNameSpace.MainApp::.ctor() stloc.0 <null> ldc.i4.0 <null> stloc.1 <null> ldsfld System.String System.String::Empty stloc.2 <null> ldloc.s V_28 newobj System.Void ModuleNameSpace.MainModuleUI::.ctor() stfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui ldloc.0 <null> ldloc.s V_28 ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui newobj System.Void ModuleNameSpace.MainModule::.ctor(ModuleNameSpace.MainAppInterface,ModuleNameSpace.MainModuleUI) stloc.3 <null> ldloc.s V_28 ldc.i4.0 <null> newobj System.Void System.Threading.ManualResetEvent::.ctor(System.Boolean) stfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre call System.AppDomain System.AppDomain::get_CurrentDomain() ldnull <null> ldftn System.Void ModuleNameSpace.MainApp::CurrentDomain_UnhandledException(System.Object,System.UnhandledExceptionEventArgs) newobj System.Void System.UnhandledExceptionEventHandler::.ctor(System.Object,System.IntPtr) callvirt System.Void System.AppDomain::add_UnhandledException(System.UnhandledExceptionEventHandler) ldloc.3 <null> call System.Management.Automation.Runspaces.Runspace System.Management.Automation.Runspaces.RunspaceFactory::CreateRunspace(System.Management.Automation.Host.PSHost) stloc.s V_4 ldloc.s V_4 ldc.i4.0 <null> callvirt System.Void System.Management.Automation.Runspaces.Runspace::set_ApartmentState(System.Threading.ApartmentState) ldloc.s V_4 callvirt System.Void System.Management.Automation.Runspaces.Runspace::Open() call System.Management.Automation.PowerShell System.Management.Automation.PowerShell::Create() stloc.s V_5 ldloc.s V_5 ldloc.s V_4 callvirt System.Void System.Management.Automation.PowerShell::set_Runspace(System.Management.Automation.Runspaces.Runspace) ldloc.s V_5 callvirt System.Management.Automation.PSDataStreams System.Management.Automation.PowerShell::get_Streams() callvirt System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord> System.Management.Automation.PSDataStreams::get_Error() ldloc.s V_25 brtrue.s IL_00A6: ldloc.s V_25 ldloc.s V_28 ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__0(System.Object,System.Management.Automation.DataAddedEventArgs) newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr) stloc.s V_25 ldloc.s V_25 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.ErrorRecord>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>) newobj System.Void System.Management.Automation.PSDataCollection`1<System.String>::.ctor() stloc.s V_6 call System.Boolean ModuleNameSpace.Console_Info::IsInputRedirected() brfalse.s IL_00D7: ldloc.s V_6 ldstr stloc.s V_7 br.s IL_00CD: call System.String System.Console::ReadLine() ldloc.s V_6 ldloc.s V_7 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Add(System.String) call System.String System.Console::ReadLine() dup <null> stloc.s V_7 brtrue.s IL_00C4: ldloc.s V_6 ldloc.s V_6 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.String>::Complete() newobj System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::.ctor() stloc.s V_8 ldloc.s V_8 ldloc.s V_26 brtrue.s IL_00FA: ldloc.s V_26 ldloc.s V_28 ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__1(System.Object,System.Management.Automation.DataAddedEventArgs) newobj System.Void System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>::.ctor(System.Object,System.IntPtr) stloc.s V_26 ldloc.s V_26 callvirt System.Void System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>::add_DataAdded(System.EventHandler`1<System.Management.Automation.DataAddedEventArgs>) ldc.i4.0 <null> stloc.s V_9 ldc.i4.0 <null> stloc.s V_10 ldc.i4.0 <null> stloc.s V_11 ldstr stloc.s V_12 ldarg.0 <null> stloc.s V_30 ldc.i4.0 <null> stloc.s V_31 br IL_022E: ldloc.s V_31 ldloc.s V_30 ldloc.s V_31 ldelem.ref <null> stloc.s V_13 ldloc.s V_13 ldstr -wait ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_0139: ldloc.s V_13 ldc.i4.1 <null> stloc.1 <null> br IL_0222: ldloc.s V_10 ldloc.s V_13 ldstr -extract ldc.i4.3 <null> callvirt System.Boolean System.String::StartsWith(System.String,System.StringComparison) brfalse.s IL_01A9: ldloc.s V_13 ldloc.s V_13 ldc.i4.1 <null> newarr System.String stloc.s V_32 ldloc.s V_32 ldc.i4.0 <null> ldstr : stelem.ref <null> ldloc.s V_32 ldc.i4.2 <null> ldc.i4.1 <null> callvirt System.String[] System.String::Split(System.String[],System.Int32,System.StringSplitOptions) stloc.s V_14 ldloc.s V_14 ldlen <null> conv.i4 <null> ldc.i4.2 <null> beq.s IL_018D: ldloc.s V_14 ldstr If you specify the -extract option you need to add a file for extraction in this way -extract:"<filename>" call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> ldc.i4.1 <null> stloc.s V_29 leave IL_05EF: ldloc.s V_29 ldloc.s V_14 ldc.i4.1 <null> ldelem.ref <null> ldc.i4.1 <null> newarr System.Char stloc.s V_33 ldloc.s V_33 ldc.i4.0 <null> ldc.i4.s 34 stelem.i2 <null> ldloc.s V_33 callvirt System.String System.String::Trim(System.Char[]) stloc.2 <null> br.s IL_0222: ldloc.s V_10 ldloc.s V_13 ldstr -end ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_01C0: ldloc.s V_13 ldloc.s V_10 ldc.i4.1 <null> add <null> stloc.s V_9 br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_13 ldstr -? ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_01D4: ldloc.s V_11 ldc.i4.1 <null> stloc.s V_11 br.s IL_0222: ldloc.s V_10 ldloc.s V_11 brfalse.s IL_020B: ldloc.s V_13 ldloc.s V_13 ldstr -detailed ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brfalse.s IL_0205: ldloc.s V_13 ldloc.s V_13 ldstr -examples ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brfalse.s IL_0205: ldloc.s V_13 ldloc.s V_13 ldstr -full ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_0222: ldloc.s V_10 ldloc.s V_13 stloc.s V_12 br.s IL_0222: ldloc.s V_10 ldloc.s V_13 ldstr -debug ldc.i4.1 <null> call System.Int32 System.String::Compare(System.String,System.String,System.Boolean) brtrue.s IL_0222: ldloc.s V_10 call System.Boolean System.Diagnostics.Debugger::Launch() pop <null> br.s IL_0239: call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() ldloc.s V_10 ldc.i4.1 <null> add <null> stloc.s V_10 ldloc.s V_31 ldc.i4.1 <null> add <null> stloc.s V_31 ldloc.s V_31 ldloc.s V_30 ldlen <null> conv.i4 <null> blt IL_011C: ldloc.s V_30 call System.Reflection.Assembly System.Reflection.Assembly::GetExecutingAssembly() stloc.s V_15 ldloc.s V_15 ldstr protected_modified_stub_sihost_20250701_131707_20250701_131707.ps1 callvirt System.IO.Stream System.Reflection.Assembly::GetManifestResourceStream(System.String) stloc.s V_16 ldloc.s V_16 call System.Text.Encoding System.Text.Encoding::get_UTF8() newobj System.Void System.IO.StreamReader::.ctor(System.IO.Stream,System.Text.Encoding) stloc.s V_17 ldloc.s V_17 callvirt System.String System.IO.TextReader::ReadToEnd() stloc.s V_18 ldloc.2 <null> call System.Boolean System.String::IsNullOrEmpty(System.String) brtrue.s IL_027D: ldloc.s V_11 ldloc.2 <null> ldloc.s V_18 call System.Void System.IO.File::WriteAllText(System.String,System.String) ldc.i4.0 <null> stloc.s V_29 leave IL_05EF: ldloc.s V_29 ldloc.s V_11 brfalse.s IL_02F0: ldloc.s V_5 ldloc.s V_5 ldc.i4.s 9 newarr System.String stloc.s V_34 ldloc.s V_34 ldc.i4.0 <null> ldstr function stelem.ref <null> ldloc.s V_34 ldc.i4.1 <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() stelem.ref <null> ldloc.s V_34 ldc.i4.2 <null> ldstr { stelem.ref <null> ldloc.s V_34 ldc.i4.3 <null> ldloc.s V_18 stelem.ref <null> ldloc.s V_34 ldc.i4.4 <null> ldstr }; Get-Help stelem.ref <null> ldloc.s V_34 ldc.i4.5 <null> call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() stelem.ref <null> ldloc.s V_34 ldc.i4.6 <null> ldstr stelem.ref <null> ldloc.s V_34 ldc.i4.7 <null> ldloc.s V_12 stelem.ref <null> ldloc.s V_34 ldc.i4.8 <null> ldstr | Out-String stelem.ref <null> ldloc.s V_34 call System.String System.String::Concat(System.String[]) callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String) pop <null> br.s IL_02FA: leave.s IL_0308 ldloc.s V_5 ldloc.s V_18 callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddScript(System.String) pop <null> leave.s IL_0308: leave.s IL_0316 ldloc.s V_17 brfalse.s IL_0307: endfinally ldloc.s V_17 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_0316: ldloc.s V_11 ldloc.s V_16 brfalse.s IL_0315: endfinally ldloc.s V_16 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_11 brtrue IL_0515: ldloc.s V_5 ldnull <null> stloc.s V_19 ldstr ^-([^: ]+)[ :]?([^:]*)$ newobj System.Void System.Text.RegularExpressions.Regex::.ctor(System.String) stloc.s V_20 ldloc.s V_9 stloc.s V_21 br IL_04E3: ldloc.s V_21 ldloc.s V_20 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> callvirt System.Text.RegularExpressions.Match System.Text.RegularExpressions.Regex::Match(System.String) stloc.s V_22 ldloc.s V_22 callvirt System.Boolean System.Text.RegularExpressions.Group::get_Success() brfalse IL_04BA: ldloc.s V_19 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() callvirt System.Int32 System.Text.RegularExpressions.GroupCollection::get_Count() ldc.i4.3 <null> bne.un IL_04BA: ldloc.s V_19 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> ldloca.s V_23 call System.Boolean System.Double::TryParse(System.String,System.Double&) brtrue IL_04BA: ldloc.s V_19 ldloc.s V_19 brfalse.s IL_037E: ldloc.s V_22 ldloc.s V_5 ldloc.s V_19 callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String) pop <null> ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.String System.String::Trim() ldstr call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_03BA: ldloc.s V_22 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() stloc.s V_19 br IL_04DD: ldloc.s V_21 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldstr True call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_03FB: ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.String System.String::ToUpper() ldstr $TRUE call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_0423: ldloc.s V_22 ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldc.i4.1 <null> box System.Boolean callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br IL_04DD: ldloc.s V_21 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldstr False call System.Boolean System.String::op_Equality(System.String,System.String) brtrue.s IL_0464: ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.String System.String::ToUpper() ldstr $FALSE call System.Boolean System.String::op_Equality(System.String,System.String) brfalse.s IL_0489: ldloc.s V_5 ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldc.i4.0 <null> box System.Boolean callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br.s IL_04DD: ldloc.s V_21 ldloc.s V_5 ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.1 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() ldloc.s V_22 callvirt System.Text.RegularExpressions.GroupCollection System.Text.RegularExpressions.Match::get_Groups() ldc.i4.2 <null> callvirt System.Text.RegularExpressions.Group System.Text.RegularExpressions.GroupCollection::get_Item(System.Int32) callvirt System.String System.Text.RegularExpressions.Capture::get_Value() callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br.s IL_04DD: ldloc.s V_21 ldloc.s V_19 brfalse.s IL_04D1: ldloc.s V_5 ldloc.s V_5 ldloc.s V_19 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String,System.Object) pop <null> ldnull <null> stloc.s V_19 br.s IL_04DD: ldloc.s V_21 ldloc.s V_5 ldarg.0 <null> ldloc.s V_21 ldelem.ref <null> callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddArgument(System.Object) pop <null> ldloc.s V_21 ldc.i4.1 <null> add <null> stloc.s V_21 ldloc.s V_21 ldarg.0 <null> ldlen <null> conv.i4 <null> blt IL_0335: ldloc.s V_20 ldloc.s V_19 brfalse.s IL_04FB: ldloc.s V_5 ldloc.s V_5 ldloc.s V_19 callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String) pop <null> ldloc.s V_5 ldstr Out-String callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddCommand(System.String) pop <null> ldloc.s V_5 ldstr Stream callvirt System.Management.Automation.PowerShell System.Management.Automation.PowerShell::AddParameter(System.String) pop <null> ldloc.s V_5 ldloc.s V_6 ldloc.s V_8 ldnull <null> ldloc.s V_27 brtrue.s IL_052F: ldloc.s V_27 ldloc.s V_28 ldftn System.Void ModuleNameSpace.MainApp/<>c__DisplayClass6::<Main>b__2(System.IAsyncResult) newobj System.Void System.AsyncCallback::.ctor(System.Object,System.IntPtr) stloc.s V_27 ldloc.s V_27 ldnull <null> callvirt System.IAsyncResult System.Management.Automation.PowerShell::BeginInvoke<System.String,System.Management.Automation.PSObject>(System.Management.Automation.PSDataCollection`1<System.String>,System.Management.Automation.PSDataCollection`1<System.Management.Automation.PSObject>,System.Management.Automation.PSInvocationSettings,System.AsyncCallback,System.Object) pop <null> ldloc.0 <null> callvirt System.Boolean ModuleNameSpace.MainApp::get_ShouldExit() brtrue.s IL_0550: ldloc.s V_5 ldloc.s V_28 ldfld System.Threading.ManualResetEvent ModuleNameSpace.MainApp/<>c__DisplayClass6::mre ldc.i4.s 100 callvirt System.Boolean System.Threading.WaitHandle::WaitOne(System.Int32) brfalse.s IL_0538: ldloc.0 ldloc.s V_5 callvirt System.Void System.Management.Automation.PowerShell::Stop() ldloc.s V_5 callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo() callvirt System.Management.Automation.PSInvocationState System.Management.Automation.PSInvocationStateInfo::get_State() ldc.i4.5 <null> bne.un.s IL_0583: leave.s IL_0591 ldloc.s V_28 ldfld ModuleNameSpace.MainModuleUI ModuleNameSpace.MainApp/<>c__DisplayClass6::ui ldloc.s V_5 callvirt System.Management.Automation.PSInvocationStateInfo System.Management.Automation.PowerShell::get_InvocationStateInfo() callvirt System.Exception System.Management.Automation.PSInvocationStateInfo::get_Reason() callvirt System.String System.Exception::get_Message() callvirt System.Void System.Management.Automation.Host.PSHostUserInterface::WriteErrorLine(System.String) leave.s IL_0591: ldloc.s V_4 ldloc.s V_5 brfalse.s IL_0590: endfinally ldloc.s V_5 callvirt System.Void System.IDisposable::Dispose() endfinally <null> ldloc.s V_4 callvirt System.Void System.Management.Automation.Runspaces.Runspace::Close() leave.s IL_05A6: leave.s IL_05D0 ldloc.s V_4 brfalse.s IL_05A5: endfinally ldloc.s V_4 callvirt System.Void System.IDisposable::Dispose() endfinally <null> leave.s IL_05D0: ldloc.1 stloc.s V_24 ldstr An exception occured: ldloc.s V_24 callvirt System.String System.Exception::get_Message() call System.String System.String::Concat(System.String,System.String) call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() ldc.i4.0 <null> ldc.i4.s 16 call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String,System.Windows.Forms.MessageBoxButtons,System.Windows.Forms.MessageBoxIcon) pop <null> leave.s IL_05D0: ldloc.1 ldloc.1 <null> brfalse.s IL_05E8: ldloc.0 ldstr Click OK to exit... call System.AppDomain System.AppDomain::get_CurrentDomain() callvirt System.String System.AppDomain::get_FriendlyName() call System.Windows.Forms.DialogResult System.Windows.Forms.MessageBox::Show(System.String,System.String) pop <null> ldloc.0 <null> callvirt System.Int32 ModuleNameSpace.MainApp::get_ExitCode() ret <null> ldloc.s V_29 ret <null>

Artefacts
Name
Value
Embedded Resources

1

Suspicious Type Names (1-2 chars)

0

afd62f9f16918c40a5fb392ce298179f (73.3 KB)
An error has occurred. This application may no longer respond until reloaded. Reload 🗙