sha256,md5 false certutil.exe mshta.exe wscript.exe cscript.exe regsvr32.exe rundll32.exe msiexec.exe installutil.exe regasm.exe regsvcs.exe odbcconf.exe ieexec.exe pcalua.exe xwizard.exe ftp.exe esentutl.exe expand.exe extrac32.exe replace.exe makecab.exe presentationhost.exe msdeploy.exe aspnet_compiler.exe msconfig.exe bginfo.exe -EncodedCommand -enc -ec IEX Invoke-Expression DownloadString DownloadFile WebClient Net.WebClient bitsadmin AmsiInitFailed amsiContext -nop -noprofile bypass -windowstyle h psexec.exe psexec64.exe psexec.exe psexec64.exe \\PSEXESVC wmic.exe wmiprvse.exe wmic.exe schtasks.exe at.exe vssadmin;delete wmic;shadowcopy;delete -ma lsass sekurlsa mimikatz frombase64 tobase64 C:\Windows\SoftwareDistribution\ C:\Windows\WinSxS\ C:\Program Files\UTMStack\ C:\UTMStack\ C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\Windows Defender\ C:\Program Files (x86)\Microsoft Intune Management Extension\ edgeIT.exe Sysmon64.exe mshta.exe wscript.exe cscript.exe regsvr32.exe rundll32.exe certutil.exe installutil.exe regasm.exe regsvcs.exe schtasks.exe powershell.exe powershell_ise.exe pwsh.exe C:\Users\ C:\ProgramData\ C:\Windows\Temp\ 127.0.0.1 ::1 chrome.exe firefox.exe msedge.exe C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\UTMStack\ C:\UTMStack\ lsass.exe C:\Windows\System32\wininit.exe C:\Windows\System32\csrss.exe C:\Windows\System32\services.exe C:\Windows\System32\lsm.exe C:\Windows\System32\svchost.exe C:\Windows\System32\wbem\wmiprvse.exe C:\Windows\System32\taskmgr.exe C:\Windows\System32\MRT.exe C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\Windows Defender\ C:\Program Files\UTMStack\ C:\UTMStack\ 0x1000 0x100000 \Start Menu\Programs\Startup\ \Microsoft\Windows\Start Menu\Programs\StartUp\ C:\Windows\Temp\ \SYSVOL\ C:\Windows\System32\svchost.exe C:\Windows\SoftwareDistribution\ C:\ProgramData\Microsoft\Windows Defender\ HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run CurrentVersion\RunOnce HKLM\SYSTEM\CurrentControlSet\Services\ AppInit_DLLs Image File Execution Options \Winlogon\ C:\Windows\System32\services.exe C:\Windows\System32\svchost.exe C:\Windows\System32\msiexec.exe C:\ProgramData\Microsoft\Windows Defender\ C:\Program Files\Windows Defender\ C:\Program Files (x86)\Microsoft Intune Management Extension\ C:\Program Files\UTMStack\ C:\UTMStack\ \PSEXESVC psexec \msagent_ \isapi_ \sdlrpc \ntsvcs \Posh postex_ status_ \lsass \winreg Anonymous Pipe \chrome. \gecko_