Just a nice persistence trick to confuse DFIR investigation. Uses NtSetValueKey native API to create a hidden (null terminated) registry key. This works by adding a null byte in front of the UNICODE_STRING key valuename.
Windows persistence toolkit written in C#. For detailed usage information on each technique, see the Wiki.
SharPyShell - tiny and obfuscated ASP.NET webshell for C# web applications