Analysis
-
max time kernel
138s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
15-01-2023 08:27
Static task
static1
Behavioral task
behavioral1
Sample
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
Resource
win10v2004-20221111-en
9 signatures
150 seconds
General
-
Target
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe
-
Size
695KB
-
MD5
928fa3e8a43ce4f32e5cb5f469a4981f
-
SHA1
742c4185e8ef6a8a70b320927d0dbc13a33a7c6f
-
SHA256
c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004
-
SHA512
c625374d344ef3c607659e5a4eb0d2978e6d030d25310cc9c9ed4aa249ef9adcf50a2053035c94daa750c8ddef044208c2425e01fe759662c32eff9140e9513c
-
SSDEEP
12288:8HbpxW0j2LnZvxo1IB5DiQqyGF3S064Fd+smJjMHGT/Ksq/KsK/Ksu:8HbpxW0j2LnboqiV3p/FEZjX7iC+
Score
10/10
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
resource yara_rule behavioral1/memory/3484-142-0x00000000015A0000-0x00000000015AD000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys" c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4708 set thread context of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 -
Suspicious behavior: EnumeratesProcesses 52 IoCs
pid Process 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe Token: SeLoadDriverPrivilege 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe Token: SeDebugPrivilege 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 2052 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 82 PID 4708 wrote to memory of 2052 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 82 PID 4708 wrote to memory of 4988 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 83 PID 4708 wrote to memory of 4988 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 83 PID 4708 wrote to memory of 3568 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 84 PID 4708 wrote to memory of 3568 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 84 PID 4708 wrote to memory of 2012 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 85 PID 4708 wrote to memory of 2012 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 85 PID 4708 wrote to memory of 4048 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 86 PID 4708 wrote to memory of 4048 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 86 PID 4708 wrote to memory of 3576 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 87 PID 4708 wrote to memory of 3576 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 87 PID 4708 wrote to memory of 4564 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 88 PID 4708 wrote to memory of 4564 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 88 PID 4708 wrote to memory of 3424 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 89 PID 4708 wrote to memory of 3424 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 89 PID 4708 wrote to memory of 3872 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 90 PID 4708 wrote to memory of 3872 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 90 PID 4708 wrote to memory of 4276 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 91 PID 4708 wrote to memory of 4276 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 91 PID 4708 wrote to memory of 3336 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 92 PID 4708 wrote to memory of 3336 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 92 PID 4708 wrote to memory of 800 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 93 PID 4708 wrote to memory of 800 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 93 PID 4708 wrote to memory of 800 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 93 PID 4708 wrote to memory of 4428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 94 PID 4708 wrote to memory of 4428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 94 PID 4708 wrote to memory of 4320 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 95 PID 4708 wrote to memory of 4320 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 95 PID 4708 wrote to memory of 5028 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 96 PID 4708 wrote to memory of 5028 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 96 PID 4708 wrote to memory of 1328 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 97 PID 4708 wrote to memory of 1328 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 97 PID 4708 wrote to memory of 2856 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 98 PID 4708 wrote to memory of 2856 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 98 PID 4708 wrote to memory of 1972 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 99 PID 4708 wrote to memory of 1972 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 99 PID 4708 wrote to memory of 4732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 100 PID 4708 wrote to memory of 4732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 100 PID 4708 wrote to memory of 4192 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 101 PID 4708 wrote to memory of 4192 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 101 PID 4708 wrote to memory of 2196 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 102 PID 4708 wrote to memory of 2196 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 102 PID 4708 wrote to memory of 4268 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 103 PID 4708 wrote to memory of 4268 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 103 PID 4708 wrote to memory of 3428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 104 PID 4708 wrote to memory of 3428 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 104 PID 4708 wrote to memory of 4868 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 105 PID 4708 wrote to memory of 4868 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 105 PID 4708 wrote to memory of 732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 106 PID 4708 wrote to memory of 732 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 106 PID 4708 wrote to memory of 4996 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 107 PID 4708 wrote to memory of 4996 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 107 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108 PID 4708 wrote to memory of 3484 4708 c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"C:\Users\Admin\AppData\Local\Temp\c6135818ddc5d31afa68f42f21e1da3e19f879096298ccb84f68803847235004.exe"1⤵
- Sets service image path in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵PID:2052
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵PID:4988
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵PID:3568
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:2012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:4048
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵PID:3576
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵PID:4564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:3424
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵PID:3872
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:4276
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:3336
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵PID:800
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:4428
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:4320
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵PID:5028
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵PID:1328
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:2856
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:1972
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:4732
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"2⤵PID:4192
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:2196
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"2⤵PID:4268
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:3428
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:4868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:732
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:4996
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:3484
-