Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 05:45
Static task
static1
Behavioral task
behavioral1
Sample
c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe
Resource
win10v2004-20220812-en
General
-
Target
c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe
-
Size
178KB
-
MD5
5e27289e555900ac8239df5e2de75643
-
SHA1
9cca801fecca11f210c671b427e99d7163c3853b
-
SHA256
c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed
-
SHA512
3f404d364987b49988dcf3bff17a627802b62ab86922d935628807b505d6c22f2b7b4abd0eea6a8d3d6d4401b2972ab51d534af82a0f1edf2aa43a77448e97e6
-
SSDEEP
3072:DLhJ3a9u0owgCEef0YkjQLd5B+F4gFyVUUEmAfnWP5n9Y:/3l3es25sFtXmSM9
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 756 wuauolts.exe 2116 wuauolts.exe 3392 wuauolts.exe 3592 wuauolts.exe 3940 wuauolts.exe 4596 wuauolts.exe 1116 wuauolts.exe 860 wuauolts.exe 4972 wuauolts.exe 4904 wuauolts.exe 4856 wuauolts.exe 1744 wuauolts.exe 3484 wuauolts.exe 3728 wuauolts.exe 1736 wuauolts.exe 4244 wuauolts.exe 2812 wuauolts.exe 1484 wuauolts.exe 5056 wuauolts.exe 4028 wuauolts.exe 236 wuauolts.exe 116 wuauolts.exe 524 wuauolts.exe 3848 wuauolts.exe 3536 wuauolts.exe 3996 wuauolts.exe 2808 wuauolts.exe 4232 wuauolts.exe 428 wuauolts.exe 2284 wuauolts.exe 1764 wuauolts.exe 3748 wuauolts.exe 5084 wuauolts.exe 4988 wuauolts.exe 3060 wuauolts.exe 4852 wuauolts.exe 460 wuauolts.exe 2860 wuauolts.exe 4404 wuauolts.exe 4108 wuauolts.exe 2020 wuauolts.exe 3620 wuauolts.exe 4104 wuauolts.exe 4012 wuauolts.exe 4400 wuauolts.exe 5104 wuauolts.exe 4656 wuauolts.exe 4320 wuauolts.exe 4312 wuauolts.exe 1968 wuauolts.exe 1556 wuauolts.exe 1980 wuauolts.exe 692 wuauolts.exe 1316 wuauolts.exe 4072 wuauolts.exe 1844 wuauolts.exe 4644 wuauolts.exe 4284 wuauolts.exe 1688 wuauolts.exe 4932 wuauolts.exe 1272 wuauolts.exe 5016 wuauolts.exe 4732 wuauolts.exe 1296 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\g: Process not Found File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\t: Process not Found File opened (read-only) \??\f: Process not Found File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\p: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\p: wuauolts.exe File opened (read-only) \??\r: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\e: Process not Found File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\m: wuauolts.exe File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\z: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\f: Process not Found File opened (read-only) \??\e: wuauolts.exe File opened (read-only) \??\f: wuauolts.exe File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\f: wuauolts.exe File opened (read-only) \??\u: wuauolts.exe File opened (read-only) \??\o: Process not Found File opened (read-only) \??\o: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\o: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\n: wuauolts.exe File opened (read-only) \??\y: wuauolts.exe File opened (read-only) \??\w: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\z: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\h: wuauolts.exe File opened (read-only) \??\p: wuauolts.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 3880 c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe 756 wuauolts.exe 2116 wuauolts.exe 3392 wuauolts.exe 3592 wuauolts.exe 3940 wuauolts.exe 4596 wuauolts.exe 1116 wuauolts.exe 860 wuauolts.exe 4972 wuauolts.exe 4904 wuauolts.exe 4856 wuauolts.exe 1744 wuauolts.exe 3484 wuauolts.exe 3728 wuauolts.exe 1736 wuauolts.exe 4244 wuauolts.exe 2812 wuauolts.exe 1484 wuauolts.exe 5056 wuauolts.exe 4028 wuauolts.exe 236 wuauolts.exe 116 wuauolts.exe 524 wuauolts.exe 3848 wuauolts.exe 3536 wuauolts.exe 3996 wuauolts.exe 2808 wuauolts.exe 4232 wuauolts.exe 428 wuauolts.exe 2284 wuauolts.exe 1764 wuauolts.exe 3748 wuauolts.exe 5084 wuauolts.exe 4988 wuauolts.exe 3060 wuauolts.exe 4852 wuauolts.exe 460 wuauolts.exe 2860 wuauolts.exe 4404 wuauolts.exe 4108 wuauolts.exe 2020 wuauolts.exe 3620 wuauolts.exe 4104 wuauolts.exe 4012 wuauolts.exe 4400 wuauolts.exe 5104 wuauolts.exe 4656 wuauolts.exe 4320 wuauolts.exe 4312 wuauolts.exe 1968 wuauolts.exe 1556 wuauolts.exe 1980 wuauolts.exe 692 wuauolts.exe 1316 wuauolts.exe 4072 wuauolts.exe 1844 wuauolts.exe 4644 wuauolts.exe 4284 wuauolts.exe 1688 wuauolts.exe 4932 wuauolts.exe 1272 wuauolts.exe 5016 wuauolts.exe 4732 wuauolts.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3880 wrote to memory of 756 3880 c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe 80 PID 3880 wrote to memory of 756 3880 c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe 80 PID 3880 wrote to memory of 756 3880 c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe 80 PID 756 wrote to memory of 2116 756 wuauolts.exe 81 PID 756 wrote to memory of 2116 756 wuauolts.exe 81 PID 756 wrote to memory of 2116 756 wuauolts.exe 81 PID 2116 wrote to memory of 3392 2116 wuauolts.exe 82 PID 2116 wrote to memory of 3392 2116 wuauolts.exe 82 PID 2116 wrote to memory of 3392 2116 wuauolts.exe 82 PID 3392 wrote to memory of 3592 3392 wuauolts.exe 83 PID 3392 wrote to memory of 3592 3392 wuauolts.exe 83 PID 3392 wrote to memory of 3592 3392 wuauolts.exe 83 PID 3592 wrote to memory of 3940 3592 wuauolts.exe 84 PID 3592 wrote to memory of 3940 3592 wuauolts.exe 84 PID 3592 wrote to memory of 3940 3592 wuauolts.exe 84 PID 3940 wrote to memory of 4596 3940 wuauolts.exe 85 PID 3940 wrote to memory of 4596 3940 wuauolts.exe 85 PID 3940 wrote to memory of 4596 3940 wuauolts.exe 85 PID 4596 wrote to memory of 1116 4596 wuauolts.exe 86 PID 4596 wrote to memory of 1116 4596 wuauolts.exe 86 PID 4596 wrote to memory of 1116 4596 wuauolts.exe 86 PID 1116 wrote to memory of 860 1116 wuauolts.exe 87 PID 1116 wrote to memory of 860 1116 wuauolts.exe 87 PID 1116 wrote to memory of 860 1116 wuauolts.exe 87 PID 860 wrote to memory of 4972 860 wuauolts.exe 88 PID 860 wrote to memory of 4972 860 wuauolts.exe 88 PID 860 wrote to memory of 4972 860 wuauolts.exe 88 PID 4972 wrote to memory of 4904 4972 wuauolts.exe 89 PID 4972 wrote to memory of 4904 4972 wuauolts.exe 89 PID 4972 wrote to memory of 4904 4972 wuauolts.exe 89 PID 4904 wrote to memory of 4856 4904 wuauolts.exe 90 PID 4904 wrote to memory of 4856 4904 wuauolts.exe 90 PID 4904 wrote to memory of 4856 4904 wuauolts.exe 90 PID 4856 wrote to memory of 1744 4856 wuauolts.exe 91 PID 4856 wrote to memory of 1744 4856 wuauolts.exe 91 PID 4856 wrote to memory of 1744 4856 wuauolts.exe 91 PID 1744 wrote to memory of 3484 1744 wuauolts.exe 92 PID 1744 wrote to memory of 3484 1744 wuauolts.exe 92 PID 1744 wrote to memory of 3484 1744 wuauolts.exe 92 PID 3484 wrote to memory of 3728 3484 wuauolts.exe 93 PID 3484 wrote to memory of 3728 3484 wuauolts.exe 93 PID 3484 wrote to memory of 3728 3484 wuauolts.exe 93 PID 3728 wrote to memory of 1736 3728 wuauolts.exe 94 PID 3728 wrote to memory of 1736 3728 wuauolts.exe 94 PID 3728 wrote to memory of 1736 3728 wuauolts.exe 94 PID 1736 wrote to memory of 4244 1736 wuauolts.exe 95 PID 1736 wrote to memory of 4244 1736 wuauolts.exe 95 PID 1736 wrote to memory of 4244 1736 wuauolts.exe 95 PID 4244 wrote to memory of 2812 4244 wuauolts.exe 96 PID 4244 wrote to memory of 2812 4244 wuauolts.exe 96 PID 4244 wrote to memory of 2812 4244 wuauolts.exe 96 PID 2812 wrote to memory of 1484 2812 wuauolts.exe 97 PID 2812 wrote to memory of 1484 2812 wuauolts.exe 97 PID 2812 wrote to memory of 1484 2812 wuauolts.exe 97 PID 1484 wrote to memory of 5056 1484 wuauolts.exe 98 PID 1484 wrote to memory of 5056 1484 wuauolts.exe 98 PID 1484 wrote to memory of 5056 1484 wuauolts.exe 98 PID 5056 wrote to memory of 4028 5056 wuauolts.exe 99 PID 5056 wrote to memory of 4028 5056 wuauolts.exe 99 PID 5056 wrote to memory of 4028 5056 wuauolts.exe 99 PID 4028 wrote to memory of 236 4028 wuauolts.exe 100 PID 4028 wrote to memory of 236 4028 wuauolts.exe 100 PID 4028 wrote to memory of 236 4028 wuauolts.exe 100 PID 236 wrote to memory of 116 236 wuauolts.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe"C:\Users\Admin\AppData\Local\Temp\c21376b5312e703d05d23a9b502adbbbe5664f72ca744cf40d28aeb7f9a23aed.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3940 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1484 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:116 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:524 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3848 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3536 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3996 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2808 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4232 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:428 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2284 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1764 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3748 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5084 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4988
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3060 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4852
-
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:460 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2860 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4404 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4108 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2020 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3620 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4104 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4012 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4400 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5104 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4656 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4320
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4312 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1968 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1556 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1980 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:692 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1316 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4072 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1844 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4644 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4284 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1688 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4932 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1272 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4732 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
PID:1296 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵PID:32
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵PID:420
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵PID:3892
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Drops file in System32 directory
PID:3168 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵PID:4268
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵PID:4440
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵PID:5092
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵PID:980
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵PID:416
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵PID:2496
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵PID:3908
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵PID:4736
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵PID:2036
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Drops file in System32 directory
PID:3496 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵PID:1836
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵PID:2232
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵PID:1528
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵PID:2312
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵PID:3932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵PID:1948
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵PID:4660
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵PID:5116
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵PID:1492
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵PID:2476
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵PID:3172
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵PID:4540
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵PID:1840
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵PID:1608
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵PID:3448
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Enumerates connected drives
PID:1204 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵PID:4564
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵PID:2104
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Enumerates connected drives
PID:1032 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵PID:5140
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵PID:5168
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵PID:5192
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵PID:5216
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵PID:5244
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵PID:5268
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵PID:5292
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵PID:5324
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵PID:5384
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵PID:5408
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵PID:5432
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵PID:5464
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵PID:5488
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵PID:5512
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵PID:5540
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵PID:5584
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵PID:5616
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵PID:5652
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵PID:5680
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵PID:5712
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵PID:5740
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵PID:5768
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵PID:5808
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵PID:5836
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵PID:5876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵PID:5916
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵PID:5940
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵PID:5964
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵PID:5988
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵PID:6012
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:6036
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:6060
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:6088
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵PID:6120
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:5124
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:5260
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵PID:5456
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵PID:5548
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:5624
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:5692
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:5796
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵PID:5872
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:6028
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:6116
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:5308
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:5556
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:5776
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵PID:5184
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:6152
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:6184
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:6212
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵PID:6236
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵PID:6280
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:6312
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵
- Enumerates connected drives
PID:6344 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:6372
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵PID:6400
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:6440
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:6476
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:6512
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵PID:6540
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵PID:6576
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:6608
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵PID:6640
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵PID:6680
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵PID:6716
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:6740
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵PID:6764
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:6792
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵
- Drops file in System32 directory
PID:6820 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:6844
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵PID:6876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵PID:6900
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵PID:6924
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:6956
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵PID:6984
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:7012
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:7044
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:7076
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵PID:7112
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:7156
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵PID:6256
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:6360
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:6456
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵PID:6528
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:6660
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe122⤵PID:6808
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-