Monikers

"iis:<metabasepath>" - Allows a programmer to view and alter key IIS functionality for any webserver physically connected to this machine. "java:<classname>" - Returns a reference to an unregistered java object found in the %system root%\java\trustlib folder using the Java Virtual Machine. "script:<absolutepath>" - Returns a reference to an unregistered Windows Scripting Component or other supported script type. "clsid:<clsid>" - Returns a reference to an object by it's class ID in the registry. "WinMgmts:<string>" - Allows access to base Windows OS functionality with WMI. "OBJREF:<base64encodedstring>" - Returns access to a running object instance. "queue:<clsid/progid>" - Used to activate a queued COM+ component via MSMQ. "new:<clsid/progid>" - Allows instancing of any COM component supporting the IClassFactory pointer (including queued components).

https://scorpiosoftware.net/2022/09/18/introduction-to-monikers/

https://learn.microsoft.com/en-us/windows/win32/com/moniker-clients

https://learn.microsoft.com/en-us/previous-versions//kdccchxa(v=vs.85)?redirectedfrom=MSDN

https://leo00000.github.io/pdf/Moniker_Magic_final.pdf

https://malware.news/t/when-scriptlets-attack-the-moniker/17411

https://www.promotic.eu/en/pmdoc/ScriptLangs/VBScript/PropMeth/GetObject.htm

http://web.archive.org/web/20021001133221/http://www.aspemporium.com/aspEmporium/tutorials/GetObject/index.asp