sha256,md5 false certutil.exe mshta.exe wscript.exe cscript.exe regsvr32.exe rundll32.exe msiexec.exe installutil.exe odbcconf.exe -EncodedCommand -enc IEX Invoke-Expression DownloadString DownloadFile AmsiInitFailed -nop psexec.exe psexec64.exe psexec.exe wmiprvse.exe ntds NTDS.dit -ma lsass sekurlsa mimikatz lsadump dcsync ntdsutil.exe schtasks.exe C:\Users\ C:\Temp\ C:\Windows\Temp\ C:\Windows\System32\lsass.exe C:\Windows\System32\svchost.exe C:\Windows\System32\services.exe C:\Windows\System32\wininit.exe C:\Windows\System32\csrss.exe C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe C:\Windows\System32\dfsrs.exe C:\Windows\System32\dfssvc.exe C:\Windows\System32\dns.exe C:\Windows\System32\dnscmd.exe C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\Windows Defender\ C:\Program Files\UTMStack\ C:\UTMStack\ edgeIT.exe Sysmon64.exe C:\Windows\SoftwareDistribution\ C:\Windows\WinSxS\ repadmin.exe gpupdate.exe lsass.exe C:\Windows\System32\wininit.exe C:\Windows\System32\csrss.exe C:\Windows\System32\services.exe C:\Windows\System32\lsm.exe C:\Windows\System32\svchost.exe C:\Windows\System32\wbem\wmiprvse.exe C:\Windows\System32\taskmgr.exe C:\Windows\System32\MRT.exe C:\Windows\ADWS\Microsoft.ActiveDirectory.WebServices.exe C:\Windows\System32\dfsrs.exe C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\Windows Defender\ C:\Program Files\UTMStack\ C:\UTMStack\ 0x1000 0x100000 NTDS ntds.dit \SYSVOL\ \Start Menu\Programs\Startup\ C:\Windows\Temp\ C:\Windows\System32\dfsrs.exe C:\Windows\System32\svchost.exe C:\Windows\SoftwareDistribution\ C:\ProgramData\Microsoft\Windows Defender\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run CurrentVersion\RunOnce HKLM\SYSTEM\CurrentControlSet\Services\ AppInit_DLLs Image File Execution Options \Winlogon\ LSA\Security Packages LSA\Notification Packages LSA\Authentication Packages WDigest\UseLogonCredential C:\Windows\System32\services.exe C:\Windows\System32\svchost.exe C:\Windows\System32\msiexec.exe C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\Windows Defender\ C:\Program Files\UTMStack\ C:\UTMStack\ \PSEXESVC psexec \msagent_ \isapi_ \sdlrpc \ntsvcs \Posh postex_ status_ \lsass \winreg \netlogon \samr \lsarpc Anonymous Pipe