{"id":318,"date":"2011-12-26T09:00:02","date_gmt":"2011-12-26T09:00:02","guid":{"rendered":"http:\/\/www.hexacorn.com\/blog\/?p=318"},"modified":"2015-04-08T05:20:33","modified_gmt":"2015-04-08T05:20:33","slug":"forensic-riddle-6-answer","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2011\/12\/26\/forensic-riddle-6-answer\/","title":{"rendered":"Forensic Riddle #6 &#8211; Answer"},"content":{"rendered":"<p>Yes. It is. One way to do it is to save\u00a0its own copy\u00a0as an ADS (Alternate Data Stream) and run it from there. Once executed from ADS, the host file will be able to self-delete itself. So, technically it is a bit of cheating :), yet it works &#8211; see the screenshot for details.<\/p>\n<p><a href=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/12\/riddle6_answer.png\"><img decoding=\"async\" loading=\"lazy\" class=\"aligncenter size-medium wp-image-323\" title=\"riddle6_answer\" src=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/12\/riddle6_answer-266x300.png\" alt=\"\" width=\"266\" height=\"300\" srcset=\"https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/12\/riddle6_answer-266x300.png 266w, https:\/\/www.hexacorn.com\/blog\/wp-content\/uploads\/2011\/12\/riddle6_answer.png 559w\" sizes=\"(max-width: 266px) 100vw, 266px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Yes. It is. One way to do it is to save\u00a0its own copy\u00a0as an ADS (Alternate Data Stream) and run it from there. Once executed from ADS, the host file will be able to self-delete itself. So, technically it is &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2011\/12\/26\/forensic-riddle-6-answer\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[11],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/318"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=318"}],"version-history":[{"count":8,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions"}],"predecessor-version":[{"id":404,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/318\/revisions\/404"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=318"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=318"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=318"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}