WTFBins

  • JetBrains binaries invoke WMI


    Contributed By: Thurein Oo

    idea64.exe and rider64.exe from Jetbrains query the installed antivirus product in the exact same way that malicious programs do using the command:

    wmic /namespace:\\root\securitycenter2 path antivirusproduct get displayname,productstate