Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20/04/2023, 06:22
Static task
static1
Behavioral task
behavioral1
Sample
c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
4 signatures
150 seconds
General
-
Target
c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe
-
Size
1.2MB
-
MD5
f742053cbdcec12c128fa08914285311
-
SHA1
317e8e0b0c60811810f1c2d50abaa4b481470eff
-
SHA256
c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a
-
SHA512
6039a1e409536d46c91683ec8b9d90da40bf986ce2980802a6689b9b7fd59a21f3ae1692da3caf093ebf25c77c6fd5c6c5efcd3ab3289fc0fb5f1dd06acc2d63
-
SSDEEP
24576:lOgF4x4F2TyXJuJNPohQzhaqXnX+jdAFFXro72lL5rnX+jdAFFX:Fmm2T0JSNgakqXsYVSiLRsY
Score
7/10
Malware Config
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 428 wrote to memory of 4020 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 84 PID 428 wrote to memory of 4020 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 84 PID 428 wrote to memory of 480 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 85 PID 428 wrote to memory of 480 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 85 PID 428 wrote to memory of 480 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 85 PID 428 wrote to memory of 4456 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 86 PID 428 wrote to memory of 4456 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 86 PID 428 wrote to memory of 2560 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 87 PID 428 wrote to memory of 2560 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 87 PID 428 wrote to memory of 3892 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 88 PID 428 wrote to memory of 3892 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 88 PID 428 wrote to memory of 4888 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 89 PID 428 wrote to memory of 4888 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 89 PID 428 wrote to memory of 1500 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 90 PID 428 wrote to memory of 1500 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 90 PID 428 wrote to memory of 4188 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 91 PID 428 wrote to memory of 4188 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 91 PID 428 wrote to memory of 1356 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 92 PID 428 wrote to memory of 1356 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 92 PID 428 wrote to memory of 1564 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 93 PID 428 wrote to memory of 1564 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 93 PID 428 wrote to memory of 1548 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 94 PID 428 wrote to memory of 1548 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 94 PID 428 wrote to memory of 1544 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 95 PID 428 wrote to memory of 1544 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 95 PID 428 wrote to memory of 2848 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 96 PID 428 wrote to memory of 2848 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 96 PID 428 wrote to memory of 2180 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 97 PID 428 wrote to memory of 2180 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 97 PID 428 wrote to memory of 2240 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 98 PID 428 wrote to memory of 2240 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 98 PID 428 wrote to memory of 3660 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 99 PID 428 wrote to memory of 3660 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 99 PID 428 wrote to memory of 1652 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 100 PID 428 wrote to memory of 1652 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 100 PID 428 wrote to memory of 3680 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 101 PID 428 wrote to memory of 3680 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 101 PID 428 wrote to memory of 2244 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 102 PID 428 wrote to memory of 2244 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 102 PID 428 wrote to memory of 3320 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 103 PID 428 wrote to memory of 3320 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 103 PID 428 wrote to memory of 3320 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 103 PID 428 wrote to memory of 4432 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 104 PID 428 wrote to memory of 4432 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 104 PID 428 wrote to memory of 3668 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 105 PID 428 wrote to memory of 3668 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 105 PID 428 wrote to memory of 3720 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 106 PID 428 wrote to memory of 3720 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 106 PID 428 wrote to memory of 2312 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 107 PID 428 wrote to memory of 2312 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 107 PID 428 wrote to memory of 3508 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 108 PID 428 wrote to memory of 3508 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 108 PID 428 wrote to memory of 5044 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 109 PID 428 wrote to memory of 5044 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 109 PID 428 wrote to memory of 3140 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 110 PID 428 wrote to memory of 3140 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 110 PID 428 wrote to memory of 4868 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 111 PID 428 wrote to memory of 4868 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 111 PID 428 wrote to memory of 2188 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 112 PID 428 wrote to memory of 2188 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 112 PID 428 wrote to memory of 3156 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 113 PID 428 wrote to memory of 3156 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 113 PID 428 wrote to memory of 4728 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 114 PID 428 wrote to memory of 4728 428 c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe"C:\Users\Admin\AppData\Local\Temp\c238d32bf0ff543edd3b8e3277ca1d3a137386d6b458fdf8f98afd41813dd19a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:4020
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵PID:480
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:4456
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:2560
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"2⤵PID:3892
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"2⤵PID:4888
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"2⤵PID:1500
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:4188
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"2⤵PID:1356
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:1564
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:1548
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:1544
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"2⤵PID:2848
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"2⤵PID:2180
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"2⤵PID:2240
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:3660
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:1652
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"2⤵PID:3680
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"2⤵PID:2244
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵PID:3320
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"2⤵PID:4432
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"2⤵PID:3668
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"2⤵PID:3720
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:2312
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:3508
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:5044
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:3140
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:4868
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"2⤵PID:2188
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:3156
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"2⤵PID:4728
-