Turla surveys a system upon check-in to discover running processes using the "tasklist /v" command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.