Analysis
- max time kernel
135s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
04/04/2023, 13:09
Static task
static1
Behavioral task
behavioral1
Sample
ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe
Resource
win7-20230220-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe
- Size 1.4MB
- Sample230404-qdr79sfb23
- SHA256 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845
- MD5 00eee0233b2e2f26f90f47b0df92f54c
- SHA1 8770f975995ed9454ee4e7434fd72cc0e9e58b18
- SHA512 4fef5c8228874f3f57de8fc1ab7ea524e37c05fad9dfbfec046243d35fe665bd95d7f9f85efe0ffca4fbcdbc258836672a7e13a40fe4b879381ed04efbb6afff
- SSDEEP 24576:OA8fDqMxe4+k5arJgTq+KiaAZq7UGTp7ZjSGWTAB:OHL/UtNxSGWTAB
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Uses the VBS compiler for execution 1 TTPs
- Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3348 wrote to memory of 4208 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 83 PID 3348 wrote to memory of 4208 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 83 PID 3348 wrote to memory of 4204 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 84 PID 3348 wrote to memory of 4204 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 84 PID 3348 wrote to memory of 1064 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 85 PID 3348 wrote to memory of 1064 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 85 PID 3348 wrote to memory of 2224 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 86 PID 3348 wrote to memory of 2224 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 86 PID 3348 wrote to memory of 2836 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 87 PID 3348 wrote to memory of 2836 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 87 PID 3348 wrote to memory of 2780 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 88 PID 3348 wrote to memory of 2780 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 88 PID 3348 wrote to memory of 3412 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 89 PID 3348 wrote to memory of 3412 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 89 PID 3348 wrote to memory of 2596 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 90 PID 3348 wrote to memory of 2596 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 90 PID 3348 wrote to memory of 4012 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 91 PID 3348 wrote to memory of 4012 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 91 PID 3348 wrote to memory of 3536 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 92 PID 3348 wrote to memory of 3536 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 92 PID 3348 wrote to memory of 636 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 93 PID 3348 wrote to memory of 636 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 93 PID 3348 wrote to memory of 1228 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 94 PID 3348 wrote to memory of 1228 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 94 PID 3348 wrote to memory of 4668 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 95 PID 3348 wrote to memory of 4668 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 95 PID 3348 wrote to memory of 2920 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 96 PID 3348 wrote to memory of 2920 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 96 PID 3348 wrote to memory of 2600 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 97 PID 3348 wrote to memory of 2600 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 97 PID 3348 wrote to memory of 1012 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 98 PID 3348 wrote to memory of 1012 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 98 PID 3348 wrote to memory of 1012 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 98 PID 3348 wrote to memory of 4316 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 99 PID 3348 wrote to memory of 4316 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 99 PID 3348 wrote to memory of 1108 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 100 PID 3348 wrote to memory of 1108 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 100 PID 3348 wrote to memory of 3180 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 101 PID 3348 wrote to memory of 3180 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 101 PID 3348 wrote to memory of 3748 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 102 PID 3348 wrote to memory of 3748 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 102 PID 3348 wrote to memory of 3712 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 103 PID 3348 wrote to memory of 3712 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 103 PID 3348 wrote to memory of 436 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 104 PID 3348 wrote to memory of 436 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 104 PID 3348 wrote to memory of 436 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 104 PID 3348 wrote to memory of 4296 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 105 PID 3348 wrote to memory of 4296 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 105 PID 3348 wrote to memory of 4884 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 106 PID 3348 wrote to memory of 4884 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 106 PID 3348 wrote to memory of 4820 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 107 PID 3348 wrote to memory of 4820 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 107 PID 3348 wrote to memory of 4880 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 108 PID 3348 wrote to memory of 4880 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 108 PID 3348 wrote to memory of 1920 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 109 PID 3348 wrote to memory of 1920 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 109 PID 3348 wrote to memory of 4700 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 110 PID 3348 wrote to memory of 4700 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 110 PID 3348 wrote to memory of 5056 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 111 PID 3348 wrote to memory of 5056 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 111 PID 3348 wrote to memory of 2528 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 112 PID 3348 wrote to memory of 2528 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 112 PID 3348 wrote to memory of 180 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 113 PID 3348 wrote to memory of 180 3348 ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe"C:\Users\Admin\AppData\Local\Temp\ef7afdbd8e3a2e3f8e53033cb0bdace7e23d1d43e4b387f480af7fc88cc28845.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:4208
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:4204
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:1064
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:2224
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:2836
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵PID:2780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"2⤵PID:3412
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵PID:2596
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:4012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:3536
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:636
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"2⤵PID:1228
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:4668
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵PID:2920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:2600
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:1012
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"2⤵PID:4316
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:1108
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵PID:3180
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:3748
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:3712
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵PID:436
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:4296
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:4884
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵PID:4820
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵PID:4880
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵PID:1920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:4700
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:5056
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:2528
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵PID:180
-