Câu 16: GCIH: GIAC Certified Incident Handler

Which of the following statements describes the data below from volatility's pstree plugin?

1. A. Cmd.exe was the child process of OneDrive.exe
2. B. Chrmstp.exe was launched by MSASCuiL.exe
3. C. Explorer.exe was the parent process for firefox.exe — đáp án hiện tại
4. D. Notepad.exe was launched with Administrative privileges