in an attempt to spot exes hiding in trusted placespic.twitter.com/otYSk2bfxY
Show this thread
personal top 3 Put it on harddiskvolume1 make it an alternative data stream on C: make it an alternative data stream on tracing folder if not admin like this: type \windows\write.exe > \windows\tracing:evil.exe wmic process call create "\windows\tracing:evil.exe"
-
-
nice, for ADS it's logged as ab:c.exe (one can hunt for presence ":" after last "\" in process name)
-
umm command line or image name? lets fix command line: mklink bbqwtf.exe "%CD%:omgwtf.exe" bbqwtf
- Show replies
New conversation -
-
-
hmm, maybe that is not really weird enough at all. Lets try this: Run syswow64\cmd.exe cd \windows\sysnative type cmd.exe >%CD%:omgwtf.exe wmic process call create "%CD%:omgwtf.exe"
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
This Tweet is unavailable.
- Show replies
New conversation
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.