Skip to primary content
Skip to secondary content

Hexacorn

Hexacorn

Main menu

  • Home
  • Services
  • Products & Freebies
  • Case Studies
  • Contact Us

Category Archives: Autostart (Persistence)

Post navigation

← Older posts
Newer posts →

Beyond good ol’ Run key, Part 146

Posted on 2024-12-20 by adam

I did consider writing about:

C:\Windows\System32\WptsExtensions.dll

but this phantom DLL has been documented all over the place, so let’s look at a different one:

C:\Windows\System32\XboxNetApiSvcExtHost.dll

It’s loaded by svchost.exe on Windows 11 24H2 and Windows Server 2022.

Posted in Autostart (Persistence)

Beyond good ol’ Run key, Part 145

Posted on 2024-12-20 by adam

Windows Server 2022 launches ctfmon.exe during its start and this process’ DLL dependencies lead to an execution path that loads a phantom (non-existing) library:

C:\Windows\System32\LangDownloader.dll

So, you can drop your own and enjoy your stay!

Posted in Autostart (Persistence)

Post navigation

← Older posts
Newer posts →
Privacy Policy Proudly powered by WordPress