Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2023 08:27
Static task
static1
Behavioral task
behavioral1
Sample
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
Resource
win10v2004-20221111-en
General
-
Target
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
-
Size
695KB
-
MD5
928fa3e8a43ce4f32e5cb5f469a4981f
-
SHA1
742c4185e8ef6a8a70b320927d0dbc13a33a7c6f
-
SHA256
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
-
SHA512
c625374d344ef3c607659e5a4eb0d2978e6d030d25310cc9c9ed4aa249ef9adcf50a2053035c94daa750c8ddef044208c2425e01fe759662c32eff9140e9513c
-
SSDEEP
12288:8HbpxW0j2LnZvxo1IB5DiQqyGF3S064Fd+smJjMHGT/Ksq/KsK/Ksu:8HbpxW0j2LnboqiV3p/FEZjX7iC+
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3484-142-0x00000000015A0000-0x00000000015AD000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exedescription pid process target process PID 4708 set thread context of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exepid process 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exepid process 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exedescription pid process Token: SeDebugPrivilege 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe Token: SeLoadDriverPrivilege 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe Token: SeDebugPrivilege 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exedescription pid process target process PID 4708 wrote to memory of 2052 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_compiler.exe PID 4708 wrote to memory of 2052 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_compiler.exe PID 4708 wrote to memory of 4988 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AppLaunch.exe PID 4708 wrote to memory of 4988 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AppLaunch.exe PID 4708 wrote to memory of 3568 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe Microsoft.Workflow.Compiler.exe PID 4708 wrote to memory of 3568 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe Microsoft.Workflow.Compiler.exe PID 4708 wrote to memory of 2012 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe InstallUtil.exe PID 4708 wrote to memory of 2012 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe InstallUtil.exe PID 4708 wrote to memory of 4048 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe EdmGen.exe PID 4708 wrote to memory of 4048 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe EdmGen.exe PID 4708 wrote to memory of 3576 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe RegSvcs.exe PID 4708 wrote to memory of 3576 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe RegSvcs.exe PID 4708 wrote to memory of 4564 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe csc.exe PID 4708 wrote to memory of 4564 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe csc.exe PID 4708 wrote to memory of 3424 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_regbrowsers.exe PID 4708 wrote to memory of 3424 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_regbrowsers.exe PID 4708 wrote to memory of 3872 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ComSvcConfig.exe PID 4708 wrote to memory of 3872 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ComSvcConfig.exe PID 4708 wrote to memory of 4276 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ilasm.exe PID 4708 wrote to memory of 4276 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ilasm.exe PID 4708 wrote to memory of 3336 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_regsql.exe PID 4708 wrote to memory of 3336 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_regsql.exe PID 4708 wrote to memory of 800 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AddInProcess32.exe PID 4708 wrote to memory of 800 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AddInProcess32.exe PID 4708 wrote to memory of 800 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AddInProcess32.exe PID 4708 wrote to memory of 4428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_regiis.exe PID 4708 wrote to memory of 4428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_regiis.exe PID 4708 wrote to memory of 4320 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe SMSvcHost.exe PID 4708 wrote to memory of 4320 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe SMSvcHost.exe PID 4708 wrote to memory of 5028 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe MSBuild.exe PID 4708 wrote to memory of 5028 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe MSBuild.exe PID 4708 wrote to memory of 1328 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ServiceModelReg.exe PID 4708 wrote to memory of 1328 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ServiceModelReg.exe PID 4708 wrote to memory of 2856 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe DataSvcUtil.exe PID 4708 wrote to memory of 2856 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe DataSvcUtil.exe PID 4708 wrote to memory of 1972 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe RegAsm.exe PID 4708 wrote to memory of 1972 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe RegAsm.exe PID 4708 wrote to memory of 4732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe cvtres.exe PID 4708 wrote to memory of 4732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe cvtres.exe PID 4708 wrote to memory of 4192 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ngentask.exe PID 4708 wrote to memory of 4192 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe ngentask.exe PID 4708 wrote to memory of 2196 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe dfsvc.exe PID 4708 wrote to memory of 2196 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe dfsvc.exe PID 4708 wrote to memory of 4268 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_wp.exe PID 4708 wrote to memory of 4268 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_wp.exe PID 4708 wrote to memory of 3428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe vbc.exe PID 4708 wrote to memory of 3428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe vbc.exe PID 4708 wrote to memory of 4868 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AddInProcess.exe PID 4708 wrote to memory of 4868 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe AddInProcess.exe PID 4708 wrote to memory of 732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_state.exe PID 4708 wrote to memory of 732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe aspnet_state.exe PID 4708 wrote to memory of 4996 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe mscorsvw.exe PID 4708 wrote to memory of 4996 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe mscorsvw.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe jsc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3484-136-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3484-137-0x00000000004046C6-mapping.dmp
-
memory/3484-138-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3484-140-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3484-141-0x0000000001580000-0x0000000001589000-memory.dmpFilesize
36KB
-
memory/3484-142-0x00000000015A0000-0x00000000015AD000-memory.dmpFilesize
52KB
-
memory/4708-132-0x000001C787620000-0x000001C7876D0000-memory.dmpFilesize
704KB
-
memory/4708-133-0x000001C789360000-0x000001C7893D6000-memory.dmpFilesize
472KB
-
memory/4708-134-0x000001C7893E0000-0x000001C7893FE000-memory.dmpFilesize
120KB
-
memory/4708-135-0x00007FFA96AE0000-0x00007FFA975A1000-memory.dmpFilesize
10.8MB
-
memory/4708-139-0x00007FFA96AE0000-0x00007FFA975A1000-memory.dmpFilesize
10.8MB