Tool included with Microsoft .Net Framework. Located at: no default.
trackertrackerSandbox: execFile · Timeout: 30s
security.execution.command security.defense-evasion.bypass Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Use tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. (Injection of locally stored DLL file into target process.)
Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exeUse tracker.exe to proxy execution of an arbitrary DLL into another process. Since tracker.exe is also signed it can be used to bypass application whitelisting solutions. (Injection of locally stored DLL file into target process.)
Tracker.exe /d {PATH:.dll} /c C:\Windows\write.exetracker is a Windows LOLBin. Tool included with Microsoft .Net Framework. Located at: no default.