1338 lines
32 KiB
JSON
1338 lines
32 KiB
JSON
{
|
|
"schema_version": "1.0",
|
|
"synthetic": true,
|
|
"collected_at": "2026-10-01T12:00:00Z",
|
|
"server": {
|
|
"hostname": "domain-controller.example.test",
|
|
"operating_system": "Microsoft Windows Server 2025 Standard (synthetic)",
|
|
"os_build": "26100",
|
|
"last_boot": "2026-09-25T06:30:00Z",
|
|
"ip_addresses": [
|
|
"192.0.2.20"
|
|
],
|
|
"network_adapters": [
|
|
"Synthetic Ethernet adapter"
|
|
],
|
|
"domain": "example.test",
|
|
"platform": "windows",
|
|
"os_version": "2025",
|
|
"kernel_version": "10.0.26100",
|
|
"product_type": 2,
|
|
"domain_joined": true,
|
|
"collection_source": "Synthetic scoring regression fixture"
|
|
},
|
|
"checks": {
|
|
"system": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"roles": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"services": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"network": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"tasks": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"software": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"storage": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"shares": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
},
|
|
"certificates": {
|
|
"status": "complete",
|
|
"message": "Synthetic contract fixture; no Windows collection performed.",
|
|
"started_at": "2026-10-01T12:00:00Z",
|
|
"completed_at": "2026-10-01T12:00:01Z",
|
|
"errors": [],
|
|
"permission_limitations": [],
|
|
"limitations": [
|
|
"Synthetic fixture only."
|
|
]
|
|
}
|
|
},
|
|
"inventory": {
|
|
"roles": [
|
|
{
|
|
"name": "NET-Framework-Core",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "NET-Framework-45-Core",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "NET-Framework-45-ASPNET",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "PowerShell",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "PowerShell-V2",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "PowerShell-ISE",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "Windows-Defender",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "Storage-Services",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "File-Services",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "FS-FileServer",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "WoW64-Support",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "RSAT",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "Telnet-Client",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "Windows-Search",
|
|
"state": "Installed"
|
|
},
|
|
{
|
|
"name": "AD-Domain-Services",
|
|
"state": "Installed"
|
|
}
|
|
],
|
|
"services": [
|
|
{
|
|
"name": "bfe",
|
|
"display_name": "bfe",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 100
|
|
},
|
|
{
|
|
"name": "bits",
|
|
"display_name": "bits",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 101
|
|
},
|
|
{
|
|
"name": "brokerinfrastructure",
|
|
"display_name": "brokerinfrastructure",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 102
|
|
},
|
|
{
|
|
"name": "cbdhsvc",
|
|
"display_name": "cbdhsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 103
|
|
},
|
|
{
|
|
"name": "cdpsusersvc",
|
|
"display_name": "cdpsusersvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 104
|
|
},
|
|
{
|
|
"name": "cdpsvc",
|
|
"display_name": "cdpsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 105
|
|
},
|
|
{
|
|
"name": "clipsvc",
|
|
"display_name": "clipsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 106
|
|
},
|
|
{
|
|
"name": "coremessagingregistrar",
|
|
"display_name": "coremessagingregistrar",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 107
|
|
},
|
|
{
|
|
"name": "cryptsvc",
|
|
"display_name": "cryptsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 108
|
|
},
|
|
{
|
|
"name": "dcomlaunch",
|
|
"display_name": "dcomlaunch",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 109
|
|
},
|
|
{
|
|
"name": "defragsvc",
|
|
"display_name": "defragsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 110
|
|
},
|
|
{
|
|
"name": "deviceassociationservice",
|
|
"display_name": "deviceassociationservice",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 111
|
|
},
|
|
{
|
|
"name": "dhcp",
|
|
"display_name": "dhcp",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 112
|
|
},
|
|
{
|
|
"name": "diagnosticshub.standardcollector.service",
|
|
"display_name": "diagnosticshub.standardcollector.service",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 113
|
|
},
|
|
{
|
|
"name": "diagtrack",
|
|
"display_name": "diagtrack",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 114
|
|
},
|
|
{
|
|
"name": "dnscache",
|
|
"display_name": "dnscache",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 115
|
|
},
|
|
{
|
|
"name": "dps",
|
|
"display_name": "dps",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 116
|
|
},
|
|
{
|
|
"name": "dusmsvc",
|
|
"display_name": "dusmsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 117
|
|
},
|
|
{
|
|
"name": "eventlog",
|
|
"display_name": "eventlog",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 118
|
|
},
|
|
{
|
|
"name": "eventsystem",
|
|
"display_name": "eventsystem",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 119
|
|
},
|
|
{
|
|
"name": "fdphost",
|
|
"display_name": "fdphost",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 120
|
|
},
|
|
{
|
|
"name": "fdrespub",
|
|
"display_name": "fdrespub",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 121
|
|
},
|
|
{
|
|
"name": "fontcache",
|
|
"display_name": "fontcache",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 122
|
|
},
|
|
{
|
|
"name": "gpsvc",
|
|
"display_name": "gpsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 123
|
|
},
|
|
{
|
|
"name": "hidserv",
|
|
"display_name": "hidserv",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 124
|
|
},
|
|
{
|
|
"name": "hvhost",
|
|
"display_name": "hvhost",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 125
|
|
},
|
|
{
|
|
"name": "iphlpsvc",
|
|
"display_name": "iphlpsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 126
|
|
},
|
|
{
|
|
"name": "keyiso",
|
|
"display_name": "keyiso",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 127
|
|
},
|
|
{
|
|
"name": "ktmrm",
|
|
"display_name": "ktmrm",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 128
|
|
},
|
|
{
|
|
"name": "lanmanserver",
|
|
"display_name": "lanmanserver",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 129
|
|
},
|
|
{
|
|
"name": "lanmanworkstation",
|
|
"display_name": "lanmanworkstation",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 130
|
|
},
|
|
{
|
|
"name": "lfsvc",
|
|
"display_name": "lfsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 131
|
|
},
|
|
{
|
|
"name": "licensemanager",
|
|
"display_name": "licensemanager",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 132
|
|
},
|
|
{
|
|
"name": "lmhosts",
|
|
"display_name": "lmhosts",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 133
|
|
},
|
|
{
|
|
"name": "lsm",
|
|
"display_name": "lsm",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 134
|
|
},
|
|
{
|
|
"name": "mpssvc",
|
|
"display_name": "mpssvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 135
|
|
},
|
|
{
|
|
"name": "msdtc",
|
|
"display_name": "msdtc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 136
|
|
},
|
|
{
|
|
"name": "netlogon",
|
|
"display_name": "netlogon",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 137
|
|
},
|
|
{
|
|
"name": "netman",
|
|
"display_name": "netman",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 138
|
|
},
|
|
{
|
|
"name": "netprofm",
|
|
"display_name": "netprofm",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 139
|
|
},
|
|
{
|
|
"name": "nlasvc",
|
|
"display_name": "nlasvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 140
|
|
},
|
|
{
|
|
"name": "nsi",
|
|
"display_name": "nsi",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 141
|
|
},
|
|
{
|
|
"name": "pcasvc",
|
|
"display_name": "pcasvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 142
|
|
},
|
|
{
|
|
"name": "plugplay",
|
|
"display_name": "plugplay",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 143
|
|
},
|
|
{
|
|
"name": "policyagent",
|
|
"display_name": "policyagent",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 144
|
|
},
|
|
{
|
|
"name": "power",
|
|
"display_name": "power",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 145
|
|
},
|
|
{
|
|
"name": "profsvc",
|
|
"display_name": "profsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 146
|
|
},
|
|
{
|
|
"name": "rasman",
|
|
"display_name": "rasman",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 147
|
|
},
|
|
{
|
|
"name": "remoteaccess",
|
|
"display_name": "remoteaccess",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 148
|
|
},
|
|
{
|
|
"name": "remoteregistry",
|
|
"display_name": "remoteregistry",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 149
|
|
},
|
|
{
|
|
"name": "rpceptmapper",
|
|
"display_name": "rpceptmapper",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 150
|
|
},
|
|
{
|
|
"name": "rpcss",
|
|
"display_name": "rpcss",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 151
|
|
},
|
|
{
|
|
"name": "samss",
|
|
"display_name": "samss",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 152
|
|
},
|
|
{
|
|
"name": "schedule",
|
|
"display_name": "schedule",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 153
|
|
},
|
|
{
|
|
"name": "seclogon",
|
|
"display_name": "seclogon",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 154
|
|
},
|
|
{
|
|
"name": "securityhealthservice",
|
|
"display_name": "securityhealthservice",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 155
|
|
},
|
|
{
|
|
"name": "sens",
|
|
"display_name": "sens",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 156
|
|
},
|
|
{
|
|
"name": "sense",
|
|
"display_name": "sense",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 157
|
|
},
|
|
{
|
|
"name": "sessionenv",
|
|
"display_name": "sessionenv",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 158
|
|
},
|
|
{
|
|
"name": "shellhwdetection",
|
|
"display_name": "shellhwdetection",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 159
|
|
},
|
|
{
|
|
"name": "spooler",
|
|
"display_name": "spooler",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 160
|
|
},
|
|
{
|
|
"name": "sppsvc",
|
|
"display_name": "sppsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 161
|
|
},
|
|
{
|
|
"name": "sqlwriter",
|
|
"display_name": "sqlwriter",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 162
|
|
},
|
|
{
|
|
"name": "ssdpsrv",
|
|
"display_name": "ssdpsrv",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 163
|
|
},
|
|
{
|
|
"name": "stisvc",
|
|
"display_name": "stisvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 164
|
|
},
|
|
{
|
|
"name": "storsvc",
|
|
"display_name": "storsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 165
|
|
},
|
|
{
|
|
"name": "swprv",
|
|
"display_name": "swprv",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 166
|
|
},
|
|
{
|
|
"name": "sysmain",
|
|
"display_name": "sysmain",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 167
|
|
},
|
|
{
|
|
"name": "systemeventsbroker",
|
|
"display_name": "systemeventsbroker",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 168
|
|
},
|
|
{
|
|
"name": "termservice",
|
|
"display_name": "termservice",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 169
|
|
},
|
|
{
|
|
"name": "themes",
|
|
"display_name": "themes",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 170
|
|
},
|
|
{
|
|
"name": "timebrokersvc",
|
|
"display_name": "timebrokersvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 171
|
|
},
|
|
{
|
|
"name": "trustedinstaller",
|
|
"display_name": "trustedinstaller",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 172
|
|
},
|
|
{
|
|
"name": "ualsvc",
|
|
"display_name": "ualsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 173
|
|
},
|
|
{
|
|
"name": "uhssvc",
|
|
"display_name": "uhssvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 174
|
|
},
|
|
{
|
|
"name": "umrdpservice",
|
|
"display_name": "umrdpservice",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 175
|
|
},
|
|
{
|
|
"name": "usosvc",
|
|
"display_name": "usosvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 176
|
|
},
|
|
{
|
|
"name": "vds",
|
|
"display_name": "vds",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 177
|
|
},
|
|
{
|
|
"name": "vmicheartbeat",
|
|
"display_name": "vmicheartbeat",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 178
|
|
},
|
|
{
|
|
"name": "vmickvpexchange",
|
|
"display_name": "vmickvpexchange",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 179
|
|
},
|
|
{
|
|
"name": "vmicshutdown",
|
|
"display_name": "vmicshutdown",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 180
|
|
},
|
|
{
|
|
"name": "vmictimesync",
|
|
"display_name": "vmictimesync",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 181
|
|
},
|
|
{
|
|
"name": "vmicvss",
|
|
"display_name": "vmicvss",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 182
|
|
},
|
|
{
|
|
"name": "vss",
|
|
"display_name": "vss",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 183
|
|
},
|
|
{
|
|
"name": "w32time",
|
|
"display_name": "w32time",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 184
|
|
},
|
|
{
|
|
"name": "w3logsvc",
|
|
"display_name": "w3logsvc",
|
|
"state": "Running",
|
|
"startup": "Auto",
|
|
"account": "LocalSystem",
|
|
"pid": 185
|
|
},
|
|
{
|
|
"name": "NTDS",
|
|
"state": "Running",
|
|
"pid": 10000
|
|
}
|
|
],
|
|
"network": [
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 135,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 139,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 445,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 3389,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 5985,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49152,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49153,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49154,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49155,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49156,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49157,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49158,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49159,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49160,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49161,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49162,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49163,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49164,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49165,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49166,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49167,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49168,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Listen",
|
|
"local_address": "0.0.0.0",
|
|
"local_port": 49169,
|
|
"remote_address": "0.0.0.0",
|
|
"remote_port": 0,
|
|
"pid": 4,
|
|
"process": "System",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55000,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4000,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55001,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4001,
|
|
"process": "steam",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55002,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4002,
|
|
"process": "svchost",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55003,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4003,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55004,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4004,
|
|
"process": "steam",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55005,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4005,
|
|
"process": "svchost",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55006,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4006,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55007,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4007,
|
|
"process": "steam",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55008,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4008,
|
|
"process": "svchost",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55009,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4009,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55010,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4010,
|
|
"process": "steam",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55011,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4011,
|
|
"process": "svchost",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55012,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4012,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55013,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4013,
|
|
"process": "steam",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55014,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4014,
|
|
"process": "svchost",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55015,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4015,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55016,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4016,
|
|
"process": "steam",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55017,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4017,
|
|
"process": "svchost",
|
|
"direction": "Unknown"
|
|
},
|
|
{
|
|
"state": "Established",
|
|
"local_address": "192.0.2.20",
|
|
"local_port": 55018,
|
|
"remote_address": "198.51.100.20",
|
|
"remote_port": 443,
|
|
"pid": 4018,
|
|
"process": "chrome",
|
|
"direction": "Unknown"
|
|
}
|
|
],
|
|
"tasks": [
|
|
{
|
|
"name": "Scheduled maintenance",
|
|
"path": "\\Microsoft\\Windows\\Maintenance\\",
|
|
"enabled": true,
|
|
"state": "Ready",
|
|
"triggers": "Daily 03:00"
|
|
}
|
|
],
|
|
"software": [],
|
|
"storage": [
|
|
{
|
|
"type": "SMB Share",
|
|
"name": "ADMIN$",
|
|
"path": "C:\\Windows",
|
|
"special": true
|
|
},
|
|
{
|
|
"type": "SMB Share",
|
|
"name": "C$",
|
|
"path": "C:\\",
|
|
"special": true
|
|
},
|
|
{
|
|
"type": "SMB Share",
|
|
"name": "IPC$",
|
|
"path": "",
|
|
"special": true
|
|
}
|
|
],
|
|
"certificates": []
|
|
}
|
|
}
|