sha256,imphash true false \powershell.exe \pwsh.exe \cmd.exe \wscript.exe \cscript.exe \mshta.exe \rundll32.exe \regsvr32.exe \certutil.exe \bitsadmin.exe \msiexec.exe \cmstp.exe \installutil.exe \regasm.exe \regsvcs.exe \msbuild.exe \psexec.exe \psexesvc.exe \procdump.exe \whoami.exe \nltest.exe \dsquery.exe \net.exe \net1.exe \sc.exe \schtasks.exe \wevtutil.exe \vssadmin.exe \wbadmin.exe \bcdedit.exe -encodedcommand;-enc ;-enc";-enc';-windowstyle hidden;-w hidden;-nop;-noni downloadstring;downloadfile;invoke-expression;iex(;invoke-webrequest;iwr ;start-bitstransfer;frombase64string;reflection.assembly sekurlsa;logonpasswords;lsadump;dcsync;minidump;comsvcs.dll delete shadows;shadowcopy delete;delete catalog;resize shadowstorage;recoveryenabled no;bootstatuspolicy ignoreallfailures wevtutil cl ;clear-eventlog;remove-eventlog schtasks /create;sc.exe create;sc create \Temp\ \AppData\ \Downloads\ \Users\Public\ \$Recycle.Bin\ \powershell.exe \pwsh.exe \cmd.exe \wscript.exe \cscript.exe \mshta.exe \rundll32.exe \regsvr32.exe \certutil.exe \bitsadmin.exe \msiexec.exe \cmstp.exe 4444;5555;6666;1234;31337 false \lsass.exe \services.exe \svchost.exe \winlogon.exe false \lsass.exe \winlogon.exe \services.exe \svchost.exe \explorer.exe \lsass.exe 0x1010;0x1038;0x1410;0x1438;0x143a;0x1fffff \Temp\;\AppData\;\Downloads\;\Users\Public\;\$Recycle.Bin\ .exe .dll .sys .com .scr .cpl .msi .msp .bat .cmd .ps1 .psm1 .vbs .vbe .js .jse .wsf .wsh .hta .lnk \Start Menu\Programs\Startup\ \Windows\System32\Tasks\ \CurrentVersion\Run;\CurrentVersion\RunOnce;\CurrentVersion\Policies\Explorer\Run \Winlogon\Shell;\Winlogon\Userinit;\Winlogon\Notify \Image File Execution Options\;\SilentProcessExit\ \AppInit_DLLs;\AppCertDlls \Lsa\Security Packages;\Lsa\Authentication Packages;\Lsa\Notification Packages \SYSTEM\CurrentControlSet\Services\ \ImagePath \ServiceDll \FailureCommand \ObjectName .exe:;.dll:;.ps1:;.bat:;.cmd:;.vbs:;.js:;.hta: \psexesvc;\paexec;\remcom;\csexec;\atsvc;\winreg;\svcctl;\samr;\lsarpc;\wkssvc;\DserNamePipe;\mojo.;\postex_;\status_;\MSSE- \powershell.exe \pwsh.exe \cmd.exe \wscript.exe \cscript.exe \mshta.exe \rundll32.exe \regsvr32.exe \certutil.exe \bitsadmin.exe \Temp\;\AppData\;\Downloads\;\Users\Public\;\$Recycle.Bin\ .exe .dll .sys .com .scr .cpl .msi .bat .cmd .ps1 .vbs .js .hta \Temp\;\AppData\;\Downloads\;\Users\Public\;\$Recycle.Bin\;\ProgramData\