Ttdinject.exe

Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)

Execute

Spawn process using other binary

TTDInject.exe /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /Launch "{PATH:.exe}"

Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated. — MITRE: T1127 — Privileges: Administrator

Spawn process using other binary

ttdinject.exe /ClientScenario TTDRecorder /ddload 0 /ClientParams "7 tmp.run 0 0 0 0 0 0 0 0 0 0" /launch "{PATH:.exe}"

Execute a program using ttdinject.exe. Requires administrator privileges. A log file will be created in tmp.run. The log file can be changed, but the length (7) has to be updated. — MITRE: T1127 — Privileges: Administrator