You can grab the RetroPad code and .exe from GitHub.
description: The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field ...
is the Wine text editor, designed to be compatible with its Microsoft Windows counterpart. It supports ANSI, UTF-8 and UTF-16 files, and can read (but not write) files with Unix line endings.