Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
49s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 13:35
Static task
static1
Behavioral task
behavioral1
Sample
c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe
Resource
win10v2004-20220901-en
General
-
Target
c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe
-
Size
186KB
-
MD5
68bab678bbf183fc9668707ea9dabb50
-
SHA1
707fa178034e4d3844b759eb8275525887cff554
-
SHA256
c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c
-
SHA512
8a948e2700cc09b1b51334a4b051eac781da984fbd1cce07c71bfd809b03f35e22387e301dd546b3b916f0ad9308b08018e5d3338f1337c51c4c9d8dc1a36f17
-
SSDEEP
3072:TLbKuZKzXw2RjwkfqrIWUEbskfsmbL9Nn0uNFi+O0xShCzukYr+:LhKDHpwspcb4mn9Nr5OCgCzuBK
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2396 wuauolts.exe 3212 wuauolts.exe 2156 wuauolts.exe 2208 wuauolts.exe 3352 wuauolts.exe 4648 wuauolts.exe 1356 wuauolts.exe 5068 wuauolts.exe 3432 wuauolts.exe 3708 wuauolts.exe 2256 wuauolts.exe 3008 wuauolts.exe 1172 wuauolts.exe 2372 wuauolts.exe 2152 wuauolts.exe 4432 wuauolts.exe 4412 wuauolts.exe 3764 wuauolts.exe 2632 wuauolts.exe 540 wuauolts.exe 4260 wuauolts.exe 3424 wuauolts.exe 4384 wuauolts.exe 2676 wuauolts.exe 1384 wuauolts.exe 3332 wuauolts.exe 1480 wuauolts.exe 4168 wuauolts.exe 4960 wuauolts.exe 2348 wuauolts.exe 4144 wuauolts.exe 4700 wuauolts.exe 3032 wuauolts.exe 1836 wuauolts.exe 676 wuauolts.exe 1948 wuauolts.exe 4576 wuauolts.exe 2512 wuauolts.exe 4928 wuauolts.exe 1140 wuauolts.exe 3884 wuauolts.exe 4588 wuauolts.exe 2168 wuauolts.exe 4852 wuauolts.exe 1580 wuauolts.exe 4984 wuauolts.exe 4600 wuauolts.exe 4952 wuauolts.exe 4092 wuauolts.exe 3816 wuauolts.exe 5072 wuauolts.exe 4312 wuauolts.exe 4268 wuauolts.exe 3600 wuauolts.exe 4624 wuauolts.exe 1016 wuauolts.exe 1664 wuauolts.exe 3904 wuauolts.exe 3132 wuauolts.exe 1752 wuauolts.exe 4148 wuauolts.exe 1968 wuauolts.exe 2784 wuauolts.exe 5088 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\h: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\k: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\w: Process not Found File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\q: wuauolts.exe File opened (read-only) \??\k: wuauolts.exe File opened (read-only) \??\t: Process not Found File opened (read-only) \??\f: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\k: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\y: wuauolts.exe File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\q: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\m: Process not Found File opened (read-only) \??\q: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\v: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\j: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\e: Process not Found File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\k: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\u: Process not Found File opened (read-only) \??\f: wuauolts.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 4100 c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe 2396 wuauolts.exe 3212 wuauolts.exe 2156 wuauolts.exe 2208 wuauolts.exe 3352 wuauolts.exe 4648 wuauolts.exe 1356 wuauolts.exe 5068 wuauolts.exe 3432 wuauolts.exe 3708 wuauolts.exe 2256 wuauolts.exe 3008 wuauolts.exe 1172 wuauolts.exe 2372 wuauolts.exe 2152 wuauolts.exe 4432 wuauolts.exe 4412 wuauolts.exe 3764 wuauolts.exe 2632 wuauolts.exe 540 wuauolts.exe 4260 wuauolts.exe 3424 wuauolts.exe 4384 wuauolts.exe 2676 wuauolts.exe 1384 wuauolts.exe 3332 wuauolts.exe 1480 wuauolts.exe 4168 wuauolts.exe 4960 wuauolts.exe 2348 wuauolts.exe 4144 wuauolts.exe 4700 wuauolts.exe 3032 wuauolts.exe 1836 wuauolts.exe 676 wuauolts.exe 1948 wuauolts.exe 4576 wuauolts.exe 2512 wuauolts.exe 4928 wuauolts.exe 1140 wuauolts.exe 3884 wuauolts.exe 4588 wuauolts.exe 2168 wuauolts.exe 4852 wuauolts.exe 1580 wuauolts.exe 4984 wuauolts.exe 4600 wuauolts.exe 4952 wuauolts.exe 4092 wuauolts.exe 3816 wuauolts.exe 5072 wuauolts.exe 4312 wuauolts.exe 4268 wuauolts.exe 3600 wuauolts.exe 4624 wuauolts.exe 1016 wuauolts.exe 1664 wuauolts.exe 3904 wuauolts.exe 3132 wuauolts.exe 1752 wuauolts.exe 4148 wuauolts.exe 1968 wuauolts.exe 2784 wuauolts.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 2396 4100 c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe 83 PID 4100 wrote to memory of 2396 4100 c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe 83 PID 4100 wrote to memory of 2396 4100 c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe 83 PID 2396 wrote to memory of 3212 2396 wuauolts.exe 84 PID 2396 wrote to memory of 3212 2396 wuauolts.exe 84 PID 2396 wrote to memory of 3212 2396 wuauolts.exe 84 PID 3212 wrote to memory of 2156 3212 wuauolts.exe 85 PID 3212 wrote to memory of 2156 3212 wuauolts.exe 85 PID 3212 wrote to memory of 2156 3212 wuauolts.exe 85 PID 2156 wrote to memory of 2208 2156 wuauolts.exe 86 PID 2156 wrote to memory of 2208 2156 wuauolts.exe 86 PID 2156 wrote to memory of 2208 2156 wuauolts.exe 86 PID 2208 wrote to memory of 3352 2208 wuauolts.exe 87 PID 2208 wrote to memory of 3352 2208 wuauolts.exe 87 PID 2208 wrote to memory of 3352 2208 wuauolts.exe 87 PID 3352 wrote to memory of 4648 3352 wuauolts.exe 88 PID 3352 wrote to memory of 4648 3352 wuauolts.exe 88 PID 3352 wrote to memory of 4648 3352 wuauolts.exe 88 PID 4648 wrote to memory of 1356 4648 wuauolts.exe 89 PID 4648 wrote to memory of 1356 4648 wuauolts.exe 89 PID 4648 wrote to memory of 1356 4648 wuauolts.exe 89 PID 1356 wrote to memory of 5068 1356 wuauolts.exe 90 PID 1356 wrote to memory of 5068 1356 wuauolts.exe 90 PID 1356 wrote to memory of 5068 1356 wuauolts.exe 90 PID 5068 wrote to memory of 3432 5068 wuauolts.exe 91 PID 5068 wrote to memory of 3432 5068 wuauolts.exe 91 PID 5068 wrote to memory of 3432 5068 wuauolts.exe 91 PID 3432 wrote to memory of 3708 3432 wuauolts.exe 92 PID 3432 wrote to memory of 3708 3432 wuauolts.exe 92 PID 3432 wrote to memory of 3708 3432 wuauolts.exe 92 PID 3708 wrote to memory of 2256 3708 wuauolts.exe 93 PID 3708 wrote to memory of 2256 3708 wuauolts.exe 93 PID 3708 wrote to memory of 2256 3708 wuauolts.exe 93 PID 2256 wrote to memory of 3008 2256 wuauolts.exe 94 PID 2256 wrote to memory of 3008 2256 wuauolts.exe 94 PID 2256 wrote to memory of 3008 2256 wuauolts.exe 94 PID 3008 wrote to memory of 1172 3008 wuauolts.exe 95 PID 3008 wrote to memory of 1172 3008 wuauolts.exe 95 PID 3008 wrote to memory of 1172 3008 wuauolts.exe 95 PID 1172 wrote to memory of 2372 1172 wuauolts.exe 96 PID 1172 wrote to memory of 2372 1172 wuauolts.exe 96 PID 1172 wrote to memory of 2372 1172 wuauolts.exe 96 PID 2372 wrote to memory of 2152 2372 wuauolts.exe 97 PID 2372 wrote to memory of 2152 2372 wuauolts.exe 97 PID 2372 wrote to memory of 2152 2372 wuauolts.exe 97 PID 2152 wrote to memory of 4432 2152 wuauolts.exe 98 PID 2152 wrote to memory of 4432 2152 wuauolts.exe 98 PID 2152 wrote to memory of 4432 2152 wuauolts.exe 98 PID 4432 wrote to memory of 4412 4432 wuauolts.exe 99 PID 4432 wrote to memory of 4412 4432 wuauolts.exe 99 PID 4432 wrote to memory of 4412 4432 wuauolts.exe 99 PID 4412 wrote to memory of 3764 4412 wuauolts.exe 100 PID 4412 wrote to memory of 3764 4412 wuauolts.exe 100 PID 4412 wrote to memory of 3764 4412 wuauolts.exe 100 PID 3764 wrote to memory of 2632 3764 wuauolts.exe 101 PID 3764 wrote to memory of 2632 3764 wuauolts.exe 101 PID 3764 wrote to memory of 2632 3764 wuauolts.exe 101 PID 2632 wrote to memory of 540 2632 wuauolts.exe 102 PID 2632 wrote to memory of 540 2632 wuauolts.exe 102 PID 2632 wrote to memory of 540 2632 wuauolts.exe 102 PID 540 wrote to memory of 4260 540 wuauolts.exe 103 PID 540 wrote to memory of 4260 540 wuauolts.exe 103 PID 540 wrote to memory of 4260 540 wuauolts.exe 103 PID 4260 wrote to memory of 3424 4260 wuauolts.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe"C:\Users\Admin\AppData\Local\Temp\c6755c545a7fff41b8189438102f1c776c0494df8413b4db2879933b6fce1f8c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3424 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4384 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2676 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1384 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3332 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1480 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4168 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4960 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2348 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4144 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4700 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3032 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1836 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:676 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1948 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4576 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2512 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4928 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1140 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3884 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4588 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2168 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4852 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1580 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4984 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4600 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4952 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4092 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3816 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5072 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4312 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4268 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3600 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4624 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1016 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1664 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3904 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3132 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1752 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4148 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1968 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2784 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵
- Executes dropped EXE
PID:5088 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:1352
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:1460
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:4456
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵PID:1952
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:392
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:5144
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵PID:5168
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵
- Enumerates connected drives
PID:5192 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:5216
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:5244
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:5280
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵PID:5320
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:5356
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:5396
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:5424
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:5452
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:5476
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵
- Enumerates connected drives
PID:5500 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:5524
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:5552
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:5576
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵PID:5600
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵
- Drops file in System32 directory
PID:5624 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:5648
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵PID:5672
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:5704
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵
- Drops file in System32 directory
PID:5728 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:5752
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:5780
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:5804
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵
- Enumerates connected drives
PID:5836 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵PID:5860
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:5892
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵PID:5928
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵PID:5960
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵PID:5996
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:6036
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵
- Enumerates connected drives
PID:6064 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:6100
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵PID:5184
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:5300
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵PID:5364
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵PID:5416
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵PID:5640
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:5912
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵PID:6008
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:1160
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:5272
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:5868
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵
- Drops file in System32 directory
PID:6152 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:6180
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵PID:6204
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:6228
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:6252
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵
- Enumerates connected drives
PID:6276 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:6300
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe122⤵PID:6324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-