1 little known secret of explorer.exe Windows Explorer is a beast. It does so many things when it starts that it hurts…Someti... 2024-3-3 08:33:23 | 阅读: 34 | 收藏 | Hexacorn - www.hexacorn.com cpl desk windows dodgy

1 little known secret of nslookup.exe I was recently surprised by the fact that Windows’ nslookup.exe accepts the local config fi... 2024-3-2 07:59:8 | 阅读: 24 | 收藏 | Hexacorn - www.hexacorn.com nslookuprc resolves surprised windows nslookup

How to become/continue to be a security researcher? In my post from 2018 I listed a number of strategies one can use to ‘find interesting stuff... 2024-1-21 08:59:29 | 阅读: 22 | 收藏 | Hexacorn - www.hexacorn.com windows regsvr32 ordinal software discoveries

2 little secrets of ScriptRunner.exe ScriptRunner.exe is a known lolbin, but the Lolbas project doesn’t cover all of this progra... 2024-1-14 07:9:46 | 阅读: 14 | 收藏 | Hexacorn - www.hexacorn.com appvscript mspaint lolbas

Adding character(s) to Command Line processing In my old post about certutil I mentioned that it accepts a number of less-known Unicode ch... 2024-1-13 07:39:35 | 阅读: 19 | 收藏 | Hexacorn - www.hexacorn.com quotation interpreted minus assumptions dash

Bitmap hunting in SPL, Part 2 In my previous post I introduced the concept of bitmap hunting. Today I will show another exampl... 2024-1-7 07:46:54 | 阅读: 15 | 收藏 | Hexacorn - www.hexacorn.com evt makeresults allb clusters cscript

1 little known secret of fondue.exe Same as in the previous case, we can copy the main executable fondue.exe to a different fol... 2024-1-6 09:29:25 | 阅读: 23 | 收藏 | Hexacorn - www.hexacorn.com cpl fondue appwiz

(Not) Mapping Firefox extension IDs to their names I have mapped an extensive list of Chrome Plug-in IDs to their names before. Of course, I k... 2024-1-6 07:36:45 | 阅读: 16 | 收藏 | Hexacorn - www.hexacorn.com ons python yup localized typos

Bitmap Hunting in SPL One of the most annoying hunting exercises is detecting a sequence of failures followed by a suc... 2024-1-2 01:23:21 | 阅读: 14 | 收藏 | Hexacorn - www.hexacorn.com username sys01 makeresults allstatuses doe

1 little known secret of hdwwiz.exe There is a number of .cpl files that can be loaded using their OS-native executable equival... 2024-1-1 21:21:53 | 阅读: 24 | 收藏 | Hexacorn - www.hexacorn.com hdwwiz cpl malicious loaded equivalents

1 little known secret of forfiles.exe The forfiles.exe program is a well-known lolbin. Its power comes from the /c command line a... 2023-12-31 18:21:41 | 阅读: 25 | 收藏 | Hexacorn - www.hexacorn.com forfiles malicious lolbin enumerates enumerated

1 little known secret of ieUnatt.exe on win11 The program has been changed since win10 and it now loads wdscore.dll almost immediately af... 2023-12-31 00:1:46 | 阅读: 16 | 收藏 | Hexacorn - www.hexacorn.com wdscore identical loadlibrary zeroes

1 little known secret of fsquirt.exe The program in the title of this post is not very well-known. It’s being used for some rand... 2023-12-30 05:57:39 | 阅读: 20 | 收藏 | Hexacorn - www.hexacorn.com fsquirt windows microsoft sendto roaming

1 little known secret of regsvr32.exe, take three In the past I wrote a few times about the side-effect of having 2 binaries named the same way an... 2023-12-29 07:14:48 | 阅读: 19 | 收藏 | Hexacorn - www.hexacorn.com regsvr32 windows ocx hhctrl syswow64

1 little known secret of regsvr32.exe, take two There is an archaic feature that regsvr32.exe leverages to autoregister libraries associate... 2023-12-27 08:9:35 | 阅读: 17 | 收藏 | Hexacorn - www.hexacorn.com txtfile library regsvr32 dllmain

1 little known secret of runonce.exe (32-bit) When you execute 32-bit version of runonce.exe on a 64-bit version of Windows and pass to i... 2023-12-26 23:22:47 | 阅读: 13 | 收藏 | Hexacorn - www.hexacorn.com iernonce library runonce loaded

1 little known secret of regsvr32.exe The little known secret of regsvr32.exe is…You ready?You can load multiple DLLs at... 2023-12-26 06:23:50 | 阅读: 31 | 收藏 | Hexacorn - www.hexacorn.com hhctrl ocx regsvr32 windows yup

2 less known secrets of Windows command command-driven line tools… Many Windows tools support commands f.ex.:reg.exe – QUERY, ADD, DELETE, COPY, SAVE, RE... 2023-12-25 19:15:35 | 阅读: 13 | 收藏 | Hexacorn - www.hexacorn.com identical detections getkeyname

Copyright banners – re-visited Over a decade ago I posted some random copyright banner stats from my (relatively small by... 2023-12-19 08:52:9 | 阅读: 17 | 收藏 | Hexacorn - www.hexacorn.com banners xmrig llc jean adler

Custom Install Path & portability issues If you’ve been reading my blog for a while now you will know that I love to challenge my threat... 2023-12-14 08:8:10 | 阅读: 14 | 收藏 | Hexacorn - www.hexacorn.com niauth instruments software labview ni