Added mftrace, extexport++
parent
f3e2157dd6
commit
cdd4e39fc5
|
@ -22,7 +22,10 @@ C:\Windows\SysWOW64\Atbroker.exe
|
||||||
```
|
```
|
||||||
|
|
||||||
Notes:
|
Notes:
|
||||||
Not certain if it works on Windows 10.
|
In Windows 10 you need to add registry keys under:
|
||||||
|
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Accessibility\ATs
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
|
@ -0,0 +1,31 @@
|
||||||
|
## Extexport.exe
|
||||||
|
|
||||||
|
* Functions: Execute
|
||||||
|
|
||||||
|
```
|
||||||
|
Extexport.exe c:\test foo bar
|
||||||
|
```
|
||||||
|
|
||||||
|
Acknowledgements:
|
||||||
|
* Adam - @hexacorn
|
||||||
|
|
||||||
|
Code sample:
|
||||||
|
*
|
||||||
|
|
||||||
|
Resources:
|
||||||
|
* http://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
|
||||||
|
|
||||||
|
Full path:
|
||||||
|
```
|
||||||
|
C:\Program Files\Internet Explorer\Extexport.exe
|
||||||
|
C:\Program Files\Internet Explorer(x86)\Extexport.exe
|
||||||
|
```
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
Place mozcrt19.dll, mozsqlite3.dll, sqlite3.dll inside the c:\test folder
|
||||||
|
|
||||||
|
Detection:
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
|
Loading…
Reference in New Issue