using Newtonsoft.Json.Linq;
using System.Collections.Generic;
public static void Main(string[] args)
'description': 'Report details on the running processes modules on the machine.\n\nThis plugin is informative only and could be used for forensic investigation, malware detection, and to that confirm your system processes conform to your system policies.',
'plugin_family': 'Windows',
'plugin_modification_date': '2019-08-20T00:00:00Z',
'plugin_publication_date': '2013-10-08T00:00:00Z',
'plugin_version': '1.111'
'synopsis': 'Use WMI to obtain running process module information.'
'pluginfamily': 'Windows',
'pluginname': 'Microsoft Windows Process Module Information',
'custom_description': null,
'plugin_output': 'Process_Modules_192.168.0.5.csv : lists the loaded modules for each process.\n',
'key': '3cbd4b0c870b581fc19be9b9126ffebe_67_9a34f34e-aca8-4f22-8659-caf67af1a1ff',
'name': 'Process_Modules_192.168.0.5.csv',
'hostname': '192.168.0.5'
Dictionary<string, string> nodes = new Dictionary<string, string>();
JObject rootObject = JObject.Parse(jsonString);
ParseJson(rootObject, nodes);
Console.WriteLine("JSON:");
foreach (string key in nodes.Keys)
Console.WriteLine(key + " = " + nodes[key]);
static bool ParseJson(JToken token, Dictionary<string, string> nodes, string parentLocation = "")
foreach (JToken child in token.Children())
if (token.Type == JTokenType.Property)
if (parentLocation == "")
parentLocation = ((JProperty)token).Name;
parentLocation += "." + ((JProperty)token).Name;
ParseJson(child, nodes, parentLocation);
if (nodes.ContainsKey(parentLocation))
nodes[parentLocation] += "|" + token.ToString();
nodes.Add(parentLocation, token.ToString());