LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Extexport.exe

View source

Load a DLL located in the c:\test folder with a specific name.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
01DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1218

Load a DLL located in the specified folder with one of the following names mozcrt19.dll, mozsqlite3.dll, or sqlite.dll.

COMMAND
Extexport.exe {PATH_ABSOLUTE:folder} foo bar
USE CASE
Execute dll file
PRIVILEGES
User
OPERATING SYSTEM
Windows vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\Program Files\Internet Explorer\Extexport.exe
C:\Program Files (x86)\Internet Explorer\Extexport.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

1 resources

Indicators & detection notes

  • IOC

    Extexport.exe loads dll and is execute from other folder the original path

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Adam@hexacorn