Sitting on the Lolbins, 2
August 20, 2019 in Anti-Forensics, Living off the land, LOLBins, Reusigned Binaries
Here’s a little gift from Intel – an old autorun program iAutorun.exe that is signed and can be instructed to run other programs via the content of the autorun.inf file it processes:
XP_APPS_32=c:\windows\system32\notepad.exe
XP_APPS_64=c:\windows\system32\notepad.exe
VISTA_APPS_32=c:\windows\system32\notepad.exe
VISTA_APPS_64=c:\windows\system32\notepad.exe
WIN7_APPS_32=c:\windows\system32\notepad.exe
WIN7_APPS_64=c:\windows\system32\notepad.exe
WIN8_APPS_32=c:\windows\system32\notepad.exe
WIN8_APPS_64=c:\windows\system32\notepad.exe
WINPLUS_APPS_32=c:\windows\system32\notepad.exe
WINPLUS_APPS_64=c:\windows\system32\notepad.exe
RUNMODE=WAIT
Source: an installer for IntelĀ® PROSet/Wireless software.
Comments are closed.