{"id":8701,"date":"2023-09-09T00:09:28","date_gmt":"2023-09-09T00:09:28","guid":{"rendered":"https:\/\/www.hexacorn.com\/blog\/?p=8701"},"modified":"2023-09-09T00:09:28","modified_gmt":"2023-09-09T00:09:28","slug":"lolbins-for-connoisseurs-part-2","status":"publish","type":"post","link":"https:\/\/www.hexacorn.com\/blog\/2023\/09\/09\/lolbins-for-connoisseurs-part-2\/","title":{"rendered":"Lolbins for connoisseurs\u2026 Part 2"},"content":{"rendered":"\n<p>It may sound a bit counterintuitive, but some very known lolbins often make it to places that no one ever thought would be possible&#8230;<\/p>\n\n\n\n<p>Continuing the topic I started a few days <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/08\/25\/lolbins-for-connoisseurs\/\" data-type=\"post\" data-id=\"8694\">earlier<\/a>, today I will explore a few more &#8216;popular&#8217; lolbinish executables that you may find &#8216;legitimately&#8217; present in the environments:<\/p>\n\n\n\n<p><strong>InstallUtil<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Celceo SystemAI\\InstallUtil.exe<\/li>\n\n\n\n<li>%Program Files%\\TSS\\Auto Mail Sender Birthday Edition\\InstallUtil.exe<\/li>\n\n\n\n<li>%Program Files%\\TSS\\Auto Mail Sender Standard Edition\\InstallUtil.exe<\/li>\n\n\n\n<li>%Program Files%\\TSS\\WinExt\\InstallUtil.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>RegAsm<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\ApexSQL\\ApexSQLDiff2012\\RegAsm.exe<\/li>\n\n\n\n<li>%Program Files%\\AUDIOzilla\\RegAsm.exe<\/li>\n\n\n\n<li>%Program Files%\\Common Files\\Multilizer\\NET\\1.1\\RegAsm.exe<\/li>\n\n\n\n<li>%Program Files%\\Common Files\\Multilizer\\NET\\2.0\\RegAsm.exe<\/li>\n\n\n\n<li>%Program Files%\\Common Files\\Multilizer\\NET\\4.0\\RegAsm.exe<\/li>\n\n\n\n<li>%Program Files%\\ExeShield\\regasm.exe<\/li>\n\n\n\n<li>%Program Files%\\iOpus\\iMacros\\RegAsm.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>ping<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Stellar Migrator for MS Exchange\\Ping.exe<\/li>\n\n\n\n<li>%Program Files%\\Stellar Phoenix Mailbox &#8211; Exchange Desktop\\Ping.exe<\/li>\n\n\n\n<li>%Program Files%\\Stellar Phoenix Repair for SQLite\\Ping.exe<\/li>\n\n\n\n<li>%Program Files%\\Stellar Phoenix Windows Backup Recovery\\Ping.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>Update_Execute<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Diashow XL\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\E-Mail-Converter\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\FotoArchiv XL\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\FotoWorksXL2013\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\FreeFotoWorks2013\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\HomepageFIX2013\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\MailFinder\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\MailOut\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\MEDIA Revolution\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\NewsletterDesigner\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\OnlineGalerie\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\profiSUBMIT\\Update_Execute.exe<\/li>\n\n\n\n<li>%Program Files%\\Slideshow XL\\Update_Execute.exe<\/li>\n<\/ul>\n\n\n\n<p>the latter allows you to execute any program of your choice via proxy f.ex.:<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">Update_Execute.exe c:\\windows\\notepad.exe<\/pre>\n\n\n\n<p><strong>runxx.exe<\/strong> (same as above, plus, more persistent)<\/p>\n\n\n\n<ul>\n<li>c:\\drivers\\keyb\\dritek2007\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\dritek2000\\InstPack\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\drtk2001\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\dtk30005\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\lm2003\\InstPack\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\lm3002\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\lm3003\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\lm3004\\InstPack\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\lm3004\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\keyboard\\lm3005\\runxx.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Launch_Manager\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\launchmanager\\dritek2001\\InstPack\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\launchmanager\\dt2000\\InstPack\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\launchmanager\\dt2002\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\LM\\2002\\InstPack\\runxx.exe<\/li>\n\n\n\n<li>c:\\drivers\\hotkeys\\runxx.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>instmsia.exe<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Firmware Update\\All_Package\\instmsia.exe<\/li>\n\n\n\n<li>C:\\Drivers\\7. Alcor CardReader Driver\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\Alcor Card Reader Driver\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\bc621500\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\bc621500\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\w6104600\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\w6104600\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Bluetooth\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Bluetooth\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6015600\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6015600\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6208500\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6208500\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc5104500\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc5104500\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6202600\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6202600\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6208800\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6208800\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209600\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209600\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209700\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209700\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bt520500\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bt520500\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\Card Reader Driver\\instmsia.exe<\/li>\n\n\n\n<li>c:\\drivers\\cardreader\\instmsia.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Others\\Bluetooth\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Others\\Bluetooth\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>C:\\DRIVERS\\WIN\\MULTICARD\\instmsia.exe<\/li>\n\n\n\n<li>c:\\pnp\\bluetooth\\instmsia.exe<\/li>\n\n\n\n<li>c:\\pnp\\GOB\\instmsia.exe<\/li>\n\n\n\n<li>c:\\pnp\\mobo\\Chipset\\INSTMSIA.EXE<\/li>\n\n\n\n<li>c:\\pnp\\mobo\\INSTMSIA.EXE<\/li>\n\n\n\n<li>c:\\pnp\\raid\\INSTMSIA.EXE<\/li>\n\n\n\n<li>c:\\pnp\\video\\instmsia.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\BLUETOOTH\\7ZBV19WW\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\BLUETOOTH\\7ZBV19WW\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\BLUETOOTH\\8m05bb36g04\\Win32\\instmsia.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\BLUETOOTH\\8m05bb36g04\\Win64\\instmsia.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\LMBC\\6jwa11ww\\ATTplgin\\instmsia.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\LMBC\\7twa71ww\\ATTplgin\\instmsia.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>instmsiw.exe<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Droppix\\Droppix Recorder 2.x\\Droppix Recorder\\InstMsiW.Exe<\/li>\n\n\n\n<li>%Program Files%\\Firmware Update\\All_Package\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\11. TV Tuner (Geniatech,Yuan,AverMedia) for 32-bit Windows\\Yuan\\MC163\\Win832\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\11. TV Tuner (Geniatech,Yuan,AverMedia) for 32-bit Windows\\Yuan\\MC907\\Win832\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\15. TV Tuner (Geniatech, Yuan, AverMedia)\\Yuan\\1.0.6.8051\\Win832\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\15. TV Tuner (Geniatech, Yuan, AverMedia)\\Yuan\\1.0.6.8051\\Win864\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\Drivers\\7. Alcor CardReader Driver\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\Alcor Card Reader Driver\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\bc621500\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\bc621500\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\w6104600\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bluetooth\\w6104600\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Bluetooth\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Bluetooth\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6015600\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6015600\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6208500\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\6208500\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc5104500\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc5104500\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6202600\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6202600\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6208800\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6208800\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209600\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209600\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209700\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bc6209700\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bt520500\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\bt520500\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\bt\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\Card Reader Driver\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\cardreader\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Others\\Bluetooth\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\Drivers\\Others\\Bluetooth\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\TV Tuner (Geniatech, Yuan, AverMedia)\\Yuan\\MC163\\Win832\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\drivers\\TV Tuner (Geniatech, Yuan, AverMedia)\\Yuan\\MC907\\Win832\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\DRIVERS\\WIN\\LANASIX\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\DRIVERS\\WIN\\MULTICARD\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\pnp\\bluetooth\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\pnp\\Cardreader\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\pnp\\GOB\\instmsiw.exe<\/li>\n\n\n\n<li>c:\\pnp\\mobo\\Chipset\\INSTMSIW.EXE<\/li>\n\n\n\n<li>c:\\pnp\\mobo\\INSTMSIW.EXE<\/li>\n\n\n\n<li>c:\\pnp\\raid\\INSTMSIW.EXE<\/li>\n\n\n\n<li>c:\\pnp\\video\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\BLUETOOTH\\7ZBV19WW\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\BLUETOOTH\\7ZBV19WW\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\BLUETOOTH\\8m05bb36g04\\Win32\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\BLUETOOTH\\8m05bb36g04\\Win64\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\FPR\\LZ4GO2A2_64\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\LMBC\\6jwa11ww\\ATTplgin\\instmsiw.exe<\/li>\n\n\n\n<li>C:\\SWTOOLS\\DRIVERS\\LMBC\\7twa71ww\\ATTplgin\\instmsiw.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>regsvr32<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\3D Active Button Magic\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\3D Button API\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active DJ Studio\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active MIDI DJ Console\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active Sound Editor\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active Sound Recorder\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active Sound Studio\\Active Sound Editor\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active Sound Studio\\Active Sound Recorder\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Active Waveform Analyzer\\REGSVR32.EXE<\/li>\n\n\n\n<li>%Program Files%\\Blue Squirrel\\Spam Sleuth Lite\\regsvr32.exe<\/li>\n\n\n\n<li>%Program Files%\\Firmware Update\\All_Package\\program files\\HP\\Button Manager\\Hestia\\regsvr32.exe<\/li>\n\n\n\n<li>%Program Files%\\Firmware Update\\All_Package\\program files\\HP\\Button Manager\\regsvr32.exe<\/li>\n\n\n\n<li>%Program Files%\\VoIP SIP Client SDK\\files_for_redistribution\\ActiveX\\regsvr32.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>ffmpeg<\/strong><\/p>\n\n\n\n<p>Not a hacking utility, but may come handy:<\/p>\n\n\n\n<ul>\n<li>%Program Files%\\AnvSoft\\Any Video Converter Professional\\gnu\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\AnvSoft\\Any Video Converter\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\AnvSoft\\Any Video Converter\\gnu\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Any Video Recorder\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Aura4You\\Aura Video Converter Professional\\gnu\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\BlazeVideo\\BlazeDVD 6.1\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\ClipGrab\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\CodedColor\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Convertilla\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Diashow XL\\LibAV\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\DVD Photo Slideshow Professional\\gnu\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\DVD Shrink\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\DVD to iPad Converter\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\DVDVideoSoft\\Free Audio Editor\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\DVDVideoSoft\\Free YouTube Download\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\DVDVideoSoft\\Free YouTube To MP3 Converter\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\FotoArchiv XL\\LibAV\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Freemake\\COM\\1.1\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Icecream Slideshow Maker\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Kastor Free Video Converter\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\KooRaRoo Media Free\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\MediaHuman\\Audio Converter\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Nuclear Coffee\\ConvertVid\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Nuclear Coffee\\VideoGet\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\pazera-software\\FLV_to_AVI_Converter\\tools\\FFmpeg\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\pazera-software\\MKV_to_AVI_Converter_32\\tools\\FFmpeg\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\pazera-software\\MOV_to_AVI_Converter\\tools\\FFmpeg\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\pazera-software\\MP4_to_AVI_Converter\\tools\\FFmpeg\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\pazera-software\\MP4_to_MP3_32bit\\tools\\FFmpeg\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\RadioBOSS\\Plugins\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Slideshow XL\\LibAV\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\SmartDVDCreatorPro\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\SmartDVDCreator\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Socusoft\\Socusoft 3GP Photo Slideshow\\gnu\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Socusoft\\Socusoft iPod Photo Slideshow\\gnu\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Sothink HD Movie Maker\\Encoder\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Sothink Movie DVD Maker\\Encoder\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Sothink Video Converter\\Encoder\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Sothink Video Encoder for Adobe Flash\\Encoder\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\SourceTec\\Sothink Movie DVD Maker\\Encoder\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\Stellar Phoenix Video Repair\\ffmpeg.exe<\/li>\n\n\n\n<li>%Program Files%\\YouTube Song Downloader\\ffmpeg.exe<\/li>\n<\/ul>\n\n\n\n<p>and there is more VNC as well:<\/p>\n\n\n\n<p><strong>vncviewer<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\CrossLoop\\vncviewer.exe<\/li>\n\n\n\n<li>%Program Files%\\Hammer Software\\MetaLAN Administrator 2\\VNC\\TightVNC3\\vncviewer.exe<\/li>\n\n\n\n<li>%Program Files%\\RealVNC\\VNC4\\vncviewer.exe<\/li>\n\n\n\n<li>%localappdata%\\CrossLoop\\vncviewer.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>winscp<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Lauyan\\TOWeb V6\\tools\\winscp\\WinSCP.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>downloader<\/strong> (note, all of these may require additional analysis):<\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Auslogics\\Driver Updater\\Downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\BSC Designer\\update\\Downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\Defender Pro Driver Control\\Downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\Download Master\\downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\Fake Voice 7.0\\7.0.0.0\\downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\Fake Webcam 7.4\\7.4.0.0\\downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\IDA\\downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\MurGeeMon\\Downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\Virtual Webcam 8.0\\8.0.0.0\\downloader.exe<\/li>\n\n\n\n<li>%Program Files%\\Webcam Screen Recorder 7.0\\7.0.0.0\\downloader.exe<\/li>\n\n\n\n<li>%localappdata%\\downloader.exe<\/li>\n\n\n\n<li>%localappdata%\\Temp\\hstemp\\downloader.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>javaw<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\CamShot\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\ChequePrinting.net\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\ChequeSystem\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\EasyBilling\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\EditRocket\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\Formatic\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\OMS\\OPhone Desktop Suite\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\Ovis\\jre7\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\PhotoPDF\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\PhotoX\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\RoboMail\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\SmartCalendar\\jre\\bin\\javaw.exe<\/li>\n\n\n\n<li>%Program Files%\\Sweet Home 3D\\jre6\\bin\\javaw.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>java<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\CamShot\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\ChequePrinting.net\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\ChequeSystem\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\EasyBilling\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\EditRocket\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\Formatic\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\OMS\\OPhone Desktop Suite\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\Ovis\\jre7\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\PhotoPDF\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\PhotoX\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\RoboMail\\jre\\bin\\java.exe<\/li>\n\n\n\n<li>%Program Files%\\SmartCalendar\\jre\\bin\\java.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>tar<\/strong><\/p>\n\n\n\n<ul>\n<li>%commonappdata%\\CleanMail\\tar.exe<\/li>\n\n\n\n<li>%Program Files%\\Git\\usr\\bin\\tar.exe<\/li>\n\n\n\n<li>%Program Files%\\Kingo ROOT\\tools\\tar.exe<\/li>\n\n\n\n<li>c:\\Program Files (x86)\\Common Files\\DVDVideoSoft\\bin\\tar.exe<\/li>\n<\/ul>\n\n\n\n<p><strong>undelete<\/strong><\/p>\n\n\n\n<ul>\n<li>%Program Files%\\Advanced System Optimizer 3\\Undelete.exe<\/li>\n\n\n\n<li>%Program Files%\\CleanGenius 3\\UnDelete.exe<\/li>\n\n\n\n<li>%Program Files%\\Glary Undelete\\undelete.exe<\/li>\n\n\n\n<li>%Program Files%\\Glary Utilities\\undelete.exe<\/li>\n\n\n\n<li>%Program Files%\\LSoft Technologies\\Active\\@ UNDELETE\\Undelete.exe<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>It may sound a bit counterintuitive, but some very known lolbins often make it to places that no one ever thought would be possible&#8230; Continuing the topic I started a few days earlier, today I will explore a few more &hellip; <a href=\"https:\/\/www.hexacorn.com\/blog\/2023\/09\/09\/lolbins-for-connoisseurs-part-2\/\">Continue reading <span class=\"meta-nav\">&rarr;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[15,56,64,59],"tags":[],"_links":{"self":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8701"}],"collection":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/comments?post=8701"}],"version-history":[{"count":4,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8701\/revisions"}],"predecessor-version":[{"id":8721,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/posts\/8701\/revisions\/8721"}],"wp:attachment":[{"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/media?parent=8701"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/categories?post=8701"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.hexacorn.com\/blog\/wp-json\/wp\/v2\/tags?post=8701"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}