Event JSON
{
"id": "4b53a754401e283457106b991abae45992b2a3d3873063d4a7b917ecd8b6cbc3",
"pubkey": "51ae1009e4403d821fc1c12e14bf4b40de44c7dc6177898840ca1ef9f9ebc768",
"created_at": 1724962518,
"kind": 1,
"tags": [
[
"e",
"8be781691b49844323be7791523a43cfda1b10481e513cc763b207855d275cde",
"",
"root",
"51ae1009e4403d821fc1c12e14bf4b40de44c7dc6177898840ca1ef9f9ebc768"
],
[
"e",
"b31f5bc1941da83853134019e513a706f3b32f6545285a4ca385edeedf49f0f6",
"",
"reply",
"51ae1009e4403d821fc1c12e14bf4b40de44c7dc6177898840ca1ef9f9ebc768"
],
[
"proxy",
"https://infosec.exchange/@wdormann/113047143641261710",
"web"
],
[
"imeta",
"url https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/047/139/111/583/758/original/67ff42db676e6b04.mp4",
"m video/mp4"
],
[
"p",
"51ae1009e4403d821fc1c12e14bf4b40de44c7dc6177898840ca1ef9f9ebc768"
],
[
"p",
"5ddc498388218fe5de824f2e5c02fb84a6e657690fbe00c25f2ddd0bc5080353"
],
[
"proxy",
"https://infosec.exchange/users/wdormann/statuses/113047143641261710",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/wdormann/statuses/113047143641261710",
"pink.momostr"
],
[
"-"
]
],
"content": "Note that with variant 2 (\"Target File DOS Name\" ends with a '.'), it's worth noting that there's nothing special about the '.' character. It can be just about anything. It could be a space, or a newline, or probably a wide number of characters.\n\nBut to fall victim to this requires double-clicking on the LNK file twice. The first time Windows will normalize the path and strip the MotW. The second time will invoke the target.\nhttps://media.infosec.exchange/infosec.exchange/media_attachments/files/113/047/139/111/583/758/original/67ff42db676e6b04.mp4\n",
"sig": "97a225a96d9482ec6ee8e25aee9921a66e450b9e6b016b9680b1634fee56797db2193b8b21f2fbaf0a968ff9f603c135f1548688d724e17573172d6ba8d97a60"
}