Skip to content

Instantly share code, notes, and snippets.

@chrissanders

chrissanders/gist:042abfce6c43815e7e7c604128470b6e

Created January 23, 2024 13:51
Show Gist options
  • Star 1 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save chrissanders/042abfce6c43815e7e7c604128470b6e to your computer and use it in GitHub Desktop.
Save chrissanders/042abfce6c43815e7e7c604128470b6e to your computer and use it in GitHub Desktop.
Download ZIP
InvPath35
Raw
gistfile1.txt
$charArray = @(0x57, 0x4D, 0x49, 0x43, 0x6C, 0x61, 0x73, 0x73)
$strClass = [String]::new($charArray -as [Char[]])
$wmiParams = @{
Class = $strClass
Namespace = "root\cimv2"
Filter = "Name = 'Win32_Process'"
}
Register-CimIndicationEvent @wmiParams -Action {
$tyd = "V2hvYW1pCg=="
$ytd = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($tyd))
Invoke-Expression $ytd
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment