Skip to content

Instantly share code, notes, and snippets.

@Purp1eW0lf

Purp1eW0lf/SlashAndGrab_application_extract.evtx

Created February 23, 2024 16:34
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save Purp1eW0lf/ba9752d03e28bbcc8cb3c154b9dc8f94 to your computer and use it in GitHub Desktop.
Save Purp1eW0lf/ba9752d03e28bbcc8cb3c154b9dc8f94 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
SlashAndGrab_application_extract.evtx
# Excerpt from Application.evtx EventID 0
EventData:
Data:
- "Transferred files with action 'Transfer':\r\nRunSchedulerTask.ps1\r\nRunSchedulerTaskOnce.ps1\r\n\r\nVersion: 22.10.11109.8417\r\nExecutable Path: C:\\Program Files (x86)\\ScreenConnect Client (9dd8b1107d6a42d9)\\ScreenConnect.ClientService.exe\r\n"
Channel: Application
EventID: 0
EventID_attributes:
SystemTime: "2024-02-23T04:06:06Z"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment