Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
11/09/2024, 06:14
Static task
static1
Behavioral task
behavioral1
Sample
cad39b8665d547f24e7155b856862fe0N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
cad39b8665d547f24e7155b856862fe0N.exe
Resource
win10v2004-20240802-en
General
-
Target
cad39b8665d547f24e7155b856862fe0N.exe
-
Size
41KB
-
MD5
cad39b8665d547f24e7155b856862fe0
-
SHA1
fbd2b09bad5eb7ec86afe5d0d72d2fefdfa7b42b
-
SHA256
69324e3eda4b071d11009e0dd6073710ea56e5b90125316b280ce77dcd0b014f
-
SHA512
d76f467ad38d3a9a5e8df08d0a366ca72aa2213e0a9df30d058c1ce0e1142c7fc08c76ff22f93bf3e70be84e9689ab72483b5d53a07198b687e58ea860643036
-
SSDEEP
768:DD7ouB15GZcHnyhHJIYo8ixhVHRmHRUuY:h1ASnHYo82hVHiX
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe 4808 cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4808 cad39b8665d547f24e7155b856862fe0N.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 616 4808 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 4808 wrote to memory of 616 4808 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 4808 wrote to memory of 616 4808 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 4808 wrote to memory of 616 4808 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 4808 wrote to memory of 616 4808 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 4808 wrote to memory of 616 4808 cad39b8665d547f24e7155b856862fe0N.exe 5 PID 4808 wrote to memory of 668 4808 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 4808 wrote to memory of 668 4808 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 4808 wrote to memory of 668 4808 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 4808 wrote to memory of 668 4808 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 4808 wrote to memory of 668 4808 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 4808 wrote to memory of 668 4808 cad39b8665d547f24e7155b856862fe0N.exe 7 PID 4808 wrote to memory of 788 4808 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 4808 wrote to memory of 788 4808 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 4808 wrote to memory of 788 4808 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 4808 wrote to memory of 788 4808 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 4808 wrote to memory of 788 4808 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 4808 wrote to memory of 788 4808 cad39b8665d547f24e7155b856862fe0N.exe 8 PID 4808 wrote to memory of 796 4808 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 4808 wrote to memory of 796 4808 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 4808 wrote to memory of 796 4808 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 4808 wrote to memory of 796 4808 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 4808 wrote to memory of 796 4808 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 4808 wrote to memory of 796 4808 cad39b8665d547f24e7155b856862fe0N.exe 9 PID 4808 wrote to memory of 804 4808 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 4808 wrote to memory of 804 4808 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 4808 wrote to memory of 804 4808 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 4808 wrote to memory of 804 4808 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 4808 wrote to memory of 804 4808 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 4808 wrote to memory of 804 4808 cad39b8665d547f24e7155b856862fe0N.exe 10 PID 4808 wrote to memory of 908 4808 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 4808 wrote to memory of 908 4808 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 4808 wrote to memory of 908 4808 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 4808 wrote to memory of 908 4808 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 4808 wrote to memory of 908 4808 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 4808 wrote to memory of 908 4808 cad39b8665d547f24e7155b856862fe0N.exe 11 PID 4808 wrote to memory of 956 4808 cad39b8665d547f24e7155b856862fe0N.exe 12 PID 4808 wrote to memory of 956 4808 cad39b8665d547f24e7155b856862fe0N.exe 12 PID 4808 wrote to memory of 956 4808 cad39b8665d547f24e7155b856862fe0N.exe 12 PID 4808 wrote to memory of 956 4808 cad39b8665d547f24e7155b856862fe0N.exe 12 PID 4808 wrote to memory of 956 4808 cad39b8665d547f24e7155b856862fe0N.exe 12 PID 4808 wrote to memory of 956 4808 cad39b8665d547f24e7155b856862fe0N.exe 12 PID 4808 wrote to memory of 340 4808 cad39b8665d547f24e7155b856862fe0N.exe 13 PID 4808 wrote to memory of 340 4808 cad39b8665d547f24e7155b856862fe0N.exe 13 PID 4808 wrote to memory of 340 4808 cad39b8665d547f24e7155b856862fe0N.exe 13 PID 4808 wrote to memory of 340 4808 cad39b8665d547f24e7155b856862fe0N.exe 13 PID 4808 wrote to memory of 340 4808 cad39b8665d547f24e7155b856862fe0N.exe 13 PID 4808 wrote to memory of 340 4808 cad39b8665d547f24e7155b856862fe0N.exe 13 PID 4808 wrote to memory of 408 4808 cad39b8665d547f24e7155b856862fe0N.exe 14 PID 4808 wrote to memory of 408 4808 cad39b8665d547f24e7155b856862fe0N.exe 14 PID 4808 wrote to memory of 408 4808 cad39b8665d547f24e7155b856862fe0N.exe 14 PID 4808 wrote to memory of 408 4808 cad39b8665d547f24e7155b856862fe0N.exe 14 PID 4808 wrote to memory of 408 4808 cad39b8665d547f24e7155b856862fe0N.exe 14 PID 4808 wrote to memory of 408 4808 cad39b8665d547f24e7155b856862fe0N.exe 14 PID 4808 wrote to memory of 1032 4808 cad39b8665d547f24e7155b856862fe0N.exe 15 PID 4808 wrote to memory of 1032 4808 cad39b8665d547f24e7155b856862fe0N.exe 15 PID 4808 wrote to memory of 1032 4808 cad39b8665d547f24e7155b856862fe0N.exe 15 PID 4808 wrote to memory of 1032 4808 cad39b8665d547f24e7155b856862fe0N.exe 15 PID 4808 wrote to memory of 1032 4808 cad39b8665d547f24e7155b856862fe0N.exe 15 PID 4808 wrote to memory of 1032 4808 cad39b8665d547f24e7155b856862fe0N.exe 15 PID 4808 wrote to memory of 1040 4808 cad39b8665d547f24e7155b856862fe0N.exe 16 PID 4808 wrote to memory of 1040 4808 cad39b8665d547f24e7155b856862fe0N.exe 16 PID 4808 wrote to memory of 1040 4808 cad39b8665d547f24e7155b856862fe0N.exe 16 PID 4808 wrote to memory of 1040 4808 cad39b8665d547f24e7155b856862fe0N.exe 16
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:616
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵PID:804
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵PID:340
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:668
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p1⤵PID:788
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding2⤵PID:3052
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:3884
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca2⤵PID:3972
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4040
-
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca2⤵PID:1080
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:3172
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4524
-
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding2⤵PID:2016
-
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding2⤵PID:4880
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}2⤵PID:1220
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca2⤵PID:3524
-
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca2⤵PID:5092
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:796
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS -p1⤵PID:908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵PID:956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵PID:408
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p1⤵PID:1032
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵PID:1040
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵PID:1096
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵PID:1104
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵PID:1156
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵PID:2776
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵PID:1172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵PID:1288
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵PID:1312
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵PID:1352
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵PID:1376
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵PID:1436
-
C:\Windows\system32\sihost.exesihost.exe2⤵PID:2672
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵PID:1596
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵PID:1616
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵PID:1624
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵PID:1740
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵PID:1764
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵PID:1772
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1872
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵PID:1972
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:1980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵PID:1452
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵PID:1824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵PID:1932
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p1⤵PID:2180
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵PID:2216
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵PID:2368
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵PID:2528
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵PID:2536
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2664
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵PID:2748
-
C:\Windows\sysmon.exeC:\Windows\sysmon.exe1⤵PID:2816
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵PID:2844
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵PID:2852
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵PID:2868
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵PID:2956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵PID:3444
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\cad39b8665d547f24e7155b856862fe0N.exe"C:\Users\Admin\AppData\Local\Temp\cad39b8665d547f24e7155b856862fe0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3684
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵PID:4976
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵PID:4304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵PID:3812
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3656
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵PID:5088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵PID:1512
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵PID:716