 | directory | $($a.Path) | | |
| directory | $($ENV:ExchangeInstallPath)\bin | | |
 | file | Filename: __$$RECOVERY_README$$__.html | | |
| file | Filename: $77_Install.exe | | |
| file | Filename: $77_loader.exe | | |
| file | Filename: $77_Loader.exe | | |
| file | Filename: $77_oracle.exe | | |
 | process | $ adb shell am start -a android.intent.action.VIEW -d "market://details?id=com.google.android.webview" | | |
| process | $ adb shell cmd webviewupdate disable-multiprocess | | |
| process | $ adb shell dumpsys webviewupdate | | |
| process | $ adb shell ps -A | grep -iE "nviso|webview" | | |
| directory | $APPDATA\Embarcadero | | |
| directory | $appdata\Microsoft\Windows | | |
| directory | $appdata\WindowsHelper | | |
| process | $assets = Invoke-Monkey365@param | | |
| process | $(awk 'BEGIN{printf "%c%c%c%c%c%c",101,115,120,99,108,105}') system syslog config set --reset=loghost | | |
| process | $./aws_recipes_assume_role.py --profile isecpartners --role-arn arn:aws:iam::AWS_ACCOUNT_ID:role/IAM-Scout2 --role-session-name Scout2 | | |
| process | $ base64 -D | hexdump | | |
| process | $BaseAddress = NtQueryInformationThread -ThreadHandle $hThread | | |
| process | $ bindeps() { echo "$1" $(ldd "$1" | sed -nre "s/^[^/]*(\/.*)\(0x.*\)$/\1/p"); } | | |
| process | $ bindeps `which strace` | | |
 | url | /$/boot | | |
| directory | $CASDOOR/files/ | | |
| process | $ cd autochrome | | |
| process | $ cd ScoutSuite | | |
| process | $(cmd) | | |
| process | $cmd = "echo -n '".$vault_password."' | ansible-vault encrypt --vault-password-file=".$job_dir.'/.vp'." ".$job_file." --output ".$job_file; | | |
| directory | $CODEX_HOME | | |
| directory | $D | | |
| directory | $D/.4dai8ovb | | |
| directory | \\\\$Domain\\NETLOGON\\ | | |
| process | $(echo $TERM | cut -c 3)$(echo $SHELL | cut -c 6)$(echo $TERM | cut -c 1)$(echo $TERM | cut -c 10)$(echo $TERM | cut -c 12)$(echo $SHELL | cut -c 3) system syslog config set --reset=loghost | | |
| process | $ echo -n JFIFJFIF | ndisasm -b 32/dev/stdin | | |
| directory | $ElasticInstallPath\Endpoint\cache\RansomwareDumps | | |
| directory | $env:appdata | | |
| directory | $env:AppData | | |
| directory | $env:APPDATA | | |
| directory | $env:APPDATA\CheckExtension | | |
| directory | $env:APPDATA\logicpro | | |
| directory | $env:APPDATA\Microsoft\Signatures | | |
| directory | $env:APPDATA\\Microsoft\\Windows\\Start Menu\\Programs\\Startup | | |
| directory | $env:APPDATA\Microsoft\Windows | | |
| directory | $env:APPDATA\Microsoft\Windows\Start Menu\Programs\Startup | | |
| directory | $env:APPDATA\reaper | | |
| directory | $env:appdata\WPy64-31401\python | | |
| directory | \\$env:COMPUTERNAME\$_ | | |
| file | Filename: $env:computername.txt | | |
| file | Filename: $env:computername.txt | | |
| directory | $env:LOCALAPPDATA | | |
| directory | $env:LOCALAPPDATA\EAnLaxUKaI | | |
