Windows Server 2003 and later (i.e. anything after Windows XP 32 bit) provide the where.exe program which does some of what which does, though it matches all types of files, not just executable commands. (It does not match built-in shell commands like cd.) It will even accept wildcards, so where nt* finds all files in … Read more
How can you find out which process is listening on a TCP or UDP port on Windows? [closed]
As PowerShell supports wildcards/patterns on multiple levels of a path, it’s as simple as: Get-ChildItem D:\test[1-3]\* | Remove-Item -Recurse -Force Sample tree before and after running the command: > tree /F D:. ├───test1 │ └───test1 │ └───archive │ x.txt │ ├───test2 │ └───try │ └───archive │ x.txt │ └───test3 └───model └───archive x.txt > Get-ChildItem D:\test[1-3]\*|Remove-Item … Read more
The following code executes the same code via both processes: internal class Program { private static void Main() { const string COMMAND = @”SCHTASKS /QUERY /XML ONE”; Collection<PSObject> psObjects; using (var ps = PowerShell.Create()) { ps.AddScript(COMMAND); psObjects = ps.Invoke(); } var process = new Process { StartInfo = new ProcessStartInfo { UseShellExecute = false, RedirectStandardOutput … Read more
If only kernel32.dll is being changed you could call ntdll.dll!NtReadVirtualMemory (ReadProcessMemory itself calls this function). If ntdll.dll is also seems to be changed by 3rd party process you could copy ntdll.dll to another temporary file (ntdll_copy.dll), and use it: [DllImport(“ntdll_copy.dll”, EntryPoint = “NtReadVirtualMemory”)] private static extern bool NtReadVirtualMemory(IntPtr hProcess, UIntPtr lpBaseAddress, [Out] byte[] lpBuffer, UIntPtr … Read more
Use -i option to use the particular private key or just use -load option with the session that you created in putty gui.
findstr /m /R “[0-9][0-9][0-9][0-9][0-9][0-9][0-9][0-9]” *.txt will list those files see findstr /? from the prompt.