malware source code
Ctrlk
  • Introduction
  • Code base
    • Headers
    • CRT Recreation
  • String Hashing
  • Antidebugging Methods
  • Library Loading
  • Error Handling
  • Fingerprinting
  • Wrappers and Helpers
  • Process Creation Techniques
    • WindowsRHotKey
    • WindowsRHotKeyEx
    • IeFrameOpenUrl
    • INFSectionInstallString
    • INFSectionInstallString2
    • INFSetupCommand
    • CreateProcessFromMsHTML
    • CreateProcessFromPcwUtilW
    • ShdocVwOpenUrl
    • ShellExecRunDLL
    • UrlFileProtocolHandler
    • CoShellExecute
    • UrlOpenUrl
    • ZipfldrRouteCall
    • NtCreateUserProcess
    • CreateProcessWithCfGuard
    • CoShellWindowExecute
    • RunAsNewUserDllW
    • IHxHelpPaneServer
    • WmiWin32_CreateProcess
    • IHxInteractiveUser
    • Touch Injection Click on Desktop Binary
  • Shellcode Execution
  • Compression
  • Networking
  • Lsass Related
  • Proxied Functions
  • Evasion
  • Component Object Model
  • My Projects
    • Proof-of-Concepts
    • Write-ups
Powered by GitBook
On this page

Process Creation Techniques

WindowsRHotKeyWindowsRHotKeyExIeFrameOpenUrlINFSectionInstallStringINFSectionInstallString2INFSetupCommandCreateProcessFromMsHTMLCreateProcessFromPcwUtilWShdocVwOpenUrlShellExecRunDLLUrlFileProtocolHandlerCoShellExecuteUrlOpenUrlZipfldrRouteCallNtCreateUserProcessCreateProcessWithCfGuardCoShellWindowExecuteRunAsNewUserDllWIHxHelpPaneServerWmiWin32_CreateProcessIHxInteractiveUserTouch Injection Click on Desktop Binary
PreviousMasquerade Peb as ExplorerNextWindowsRHotKey