UPDATE BOOKMARKS - PROJECT MOVED TO A DEDICATED PROJECT SITE. THIS SITE WILL NOT BE UPDATED ANYMORE, BUT WILL BE KEPT FOR HISTORICAL REASONS.

New site: https://github.com/LOLBAS-Project/LOLBAS Web portal: https://lolbas-project.github.io/

Openwith.exe

• Functions: Execute

OpenWith.exe /c C:\test.hta   

OpenWith.exe /c C:\testing.msi    

Acknowledgements:

• Matt harr0ey - @harr0ey

Code sample: *

Resources:

• https://twitter.com/harr0ey/status/991670870384021504

Full path:

c:\windows\system32\Openwith.exe
c:\windows\sysWOW64\Openwith.exe

Notes:

Detection: