in an attempt to spot exes hiding in trusted placespic.twitter.com/otYSk2bfxY
Show this thread
-
personal top 3 Put it on harddiskvolume1 make it an alternative data stream on C: make it an alternative data stream on tracing folder if not admin like this: type \windows\write.exe > \windows\tracing:evil.exe wmic process call create "\windows\tracing:evil.exe"
hmm, maybe that is not really weird enough at all. Lets try this: Run syswow64\cmd.exe cd \windows\sysnative type cmd.exe >%CD%:omgwtf.exe wmic process call create "%CD%:omgwtf.exe"