Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05-10-2024 22:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56150033.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
56150033.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
56150033.exe
-
Size
2.6MB
-
MD5
1e920633f69873d0a17572e035c3705d
-
SHA1
a45d913c71c79186e2fd60902177f82fd2ef6fdf
-
SHA256
5fc6d8ccc2bc6839c99ee4fee20050c488494d0f54ff64330380e928fa1ab9a3
-
SHA512
351578607b0504ed7d735fabc999f6d320cc571fe55e7ca721a4187976367ea93772e60ff5181451271189b8284351022c1bcab2735bb8510a17ff8d58f1c159
-
SSDEEP
49152:KzTzTzTzTzTzTzTzTzTzTzTzTzTzTzTz:MHHHHHHHHHHHHHHH
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2164 wuauolts.exe 2760 wuauolts.exe 2572 wuauolts.exe 2836 wuauolts.exe 2900 wuauolts.exe 2736 wuauolts.exe 2568 wuauolts.exe 2684 wuauolts.exe 2196 wuauolts.exe 2012 wuauolts.exe 1580 wuauolts.exe 2880 wuauolts.exe 2936 wuauolts.exe 2312 wuauolts.exe 1000 wuauolts.exe 668 wuauolts.exe 2624 wuauolts.exe 2632 wuauolts.exe 1616 wuauolts.exe 1692 wuauolts.exe 2440 wuauolts.exe 2992 wuauolts.exe 2396 wuauolts.exe 1280 wuauolts.exe 2924 wuauolts.exe 1132 wuauolts.exe 2420 wuauolts.exe 2076 wuauolts.exe 860 wuauolts.exe 1304 wuauolts.exe 2372 wuauolts.exe 1672 wuauolts.exe 1484 wuauolts.exe 1688 wuauolts.exe 1448 wuauolts.exe 1488 wuauolts.exe 3008 wuauolts.exe 1716 wuauolts.exe 1268 wuauolts.exe 1844 wuauolts.exe 1752 wuauolts.exe 2360 wuauolts.exe 2376 wuauolts.exe 1660 wuauolts.exe 744 wuauolts.exe 2016 wuauolts.exe 2508 wuauolts.exe 2840 wuauolts.exe 840 wuauolts.exe 2260 wuauolts.exe 2712 wuauolts.exe 1544 wuauolts.exe 2816 wuauolts.exe 2776 wuauolts.exe 2588 wuauolts.exe 1120 wuauolts.exe 2580 wuauolts.exe 1876 wuauolts.exe 2784 wuauolts.exe 2980 wuauolts.exe 1944 wuauolts.exe 2820 wuauolts.exe 2800 wuauolts.exe 680 wuauolts.exe -
Loads dropped DLL 64 IoCs
pid Process 2436 56150033.exe 2436 56150033.exe 2164 wuauolts.exe 2164 wuauolts.exe 2760 wuauolts.exe 2760 wuauolts.exe 2572 wuauolts.exe 2572 wuauolts.exe 2836 wuauolts.exe 2836 wuauolts.exe 2900 wuauolts.exe 2900 wuauolts.exe 2736 wuauolts.exe 2736 wuauolts.exe 2568 wuauolts.exe 2568 wuauolts.exe 2684 wuauolts.exe 2684 wuauolts.exe 2196 wuauolts.exe 2196 wuauolts.exe 2012 wuauolts.exe 2012 wuauolts.exe 1580 wuauolts.exe 1580 wuauolts.exe 2880 wuauolts.exe 2880 wuauolts.exe 2936 wuauolts.exe 2936 wuauolts.exe 2312 wuauolts.exe 2312 wuauolts.exe 1000 wuauolts.exe 1000 wuauolts.exe 668 wuauolts.exe 668 wuauolts.exe 2624 wuauolts.exe 2624 wuauolts.exe 2632 wuauolts.exe 2632 wuauolts.exe 1616 wuauolts.exe 1616 wuauolts.exe 1692 wuauolts.exe 1692 wuauolts.exe 2440 wuauolts.exe 2440 wuauolts.exe 2992 wuauolts.exe 2992 wuauolts.exe 2396 wuauolts.exe 2396 wuauolts.exe 1280 wuauolts.exe 1280 wuauolts.exe 2924 wuauolts.exe 2924 wuauolts.exe 1132 wuauolts.exe 1132 wuauolts.exe 2420 wuauolts.exe 2420 wuauolts.exe 2076 wuauolts.exe 2076 wuauolts.exe 860 wuauolts.exe 860 wuauolts.exe 1304 wuauolts.exe 1304 wuauolts.exe 2372 wuauolts.exe 2372 wuauolts.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\i: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\t: Process not Found File opened (read-only) \??\u: Process not Found File opened (read-only) \??\t: wuauolts.exe File opened (read-only) \??\m: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\v: Process not Found File opened (read-only) \??\r: wuauolts.exe File opened (read-only) \??\w: Process not Found File opened (read-only) \??\z: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\i: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\l: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\h: Process not Found File opened (read-only) \??\s: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\z: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\r: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\m: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\p: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\y: Process not Found File opened (read-only) \??\q: Process not Found File opened (read-only) \??\p: Process not Found File opened (read-only) \??\w: Process not Found File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\g: wuauolts.exe File opened (read-only) \??\x: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\e: Process not Found File opened (read-only) \??\x: wuauolts.exe File opened (read-only) \??\l: wuauolts.exe File opened (read-only) \??\i: Process not Found File opened (read-only) \??\i: wuauolts.exe File opened (read-only) \??\x: Process not Found File opened (read-only) \??\x: Process not Found File opened (read-only) \??\o: wuauolts.exe File opened (read-only) \??\q: wuauolts.exe File opened (read-only) \??\y: Process not Found File opened (read-only) \??\s: wuauolts.exe File opened (read-only) \??\z: Process not Found File opened (read-only) \??\g: Process not Found File opened (read-only) \??\h: Process not Found File opened (read-only) \??\j: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\n: Process not Found File opened (read-only) \??\w: wuauolts.exe File opened (read-only) \??\p: Process not Found -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe wuauolts.exe File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found File created C:\Windows\SysWOW64\wuauolts.exe Process not Found -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2436 56150033.exe 2164 wuauolts.exe 2760 wuauolts.exe 2572 wuauolts.exe 2836 wuauolts.exe 2900 wuauolts.exe 2736 wuauolts.exe 2568 wuauolts.exe 2684 wuauolts.exe 2196 wuauolts.exe 2012 wuauolts.exe 1580 wuauolts.exe 2880 wuauolts.exe 2936 wuauolts.exe 2312 wuauolts.exe 1000 wuauolts.exe 668 wuauolts.exe 2624 wuauolts.exe 2632 wuauolts.exe 1616 wuauolts.exe 1692 wuauolts.exe 2440 wuauolts.exe 2992 wuauolts.exe 2396 wuauolts.exe 1280 wuauolts.exe 2924 wuauolts.exe 1132 wuauolts.exe 2420 wuauolts.exe 2076 wuauolts.exe 860 wuauolts.exe 1304 wuauolts.exe 2372 wuauolts.exe 1672 wuauolts.exe 1484 wuauolts.exe 1688 wuauolts.exe 1448 wuauolts.exe 1488 wuauolts.exe 3008 wuauolts.exe 1716 wuauolts.exe 1268 wuauolts.exe 1844 wuauolts.exe 1752 wuauolts.exe 2360 wuauolts.exe 2376 wuauolts.exe 1660 wuauolts.exe 744 wuauolts.exe 2016 wuauolts.exe 2508 wuauolts.exe 2840 wuauolts.exe 840 wuauolts.exe 2260 wuauolts.exe 2712 wuauolts.exe 1544 wuauolts.exe 2816 wuauolts.exe 2776 wuauolts.exe 2588 wuauolts.exe 1120 wuauolts.exe 2580 wuauolts.exe 1876 wuauolts.exe 2784 wuauolts.exe 2980 wuauolts.exe 1944 wuauolts.exe 2820 wuauolts.exe 2800 wuauolts.exe -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wuauolts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2436 wrote to memory of 2164 2436 56150033.exe 31 PID 2436 wrote to memory of 2164 2436 56150033.exe 31 PID 2436 wrote to memory of 2164 2436 56150033.exe 31 PID 2436 wrote to memory of 2164 2436 56150033.exe 31 PID 2164 wrote to memory of 2760 2164 wuauolts.exe 32 PID 2164 wrote to memory of 2760 2164 wuauolts.exe 32 PID 2164 wrote to memory of 2760 2164 wuauolts.exe 32 PID 2164 wrote to memory of 2760 2164 wuauolts.exe 32 PID 2760 wrote to memory of 2572 2760 wuauolts.exe 33 PID 2760 wrote to memory of 2572 2760 wuauolts.exe 33 PID 2760 wrote to memory of 2572 2760 wuauolts.exe 33 PID 2760 wrote to memory of 2572 2760 wuauolts.exe 33 PID 2572 wrote to memory of 2836 2572 wuauolts.exe 34 PID 2572 wrote to memory of 2836 2572 wuauolts.exe 34 PID 2572 wrote to memory of 2836 2572 wuauolts.exe 34 PID 2572 wrote to memory of 2836 2572 wuauolts.exe 34 PID 2836 wrote to memory of 2900 2836 wuauolts.exe 35 PID 2836 wrote to memory of 2900 2836 wuauolts.exe 35 PID 2836 wrote to memory of 2900 2836 wuauolts.exe 35 PID 2836 wrote to memory of 2900 2836 wuauolts.exe 35 PID 2900 wrote to memory of 2736 2900 wuauolts.exe 36 PID 2900 wrote to memory of 2736 2900 wuauolts.exe 36 PID 2900 wrote to memory of 2736 2900 wuauolts.exe 36 PID 2900 wrote to memory of 2736 2900 wuauolts.exe 36 PID 2736 wrote to memory of 2568 2736 wuauolts.exe 37 PID 2736 wrote to memory of 2568 2736 wuauolts.exe 37 PID 2736 wrote to memory of 2568 2736 wuauolts.exe 37 PID 2736 wrote to memory of 2568 2736 wuauolts.exe 37 PID 2568 wrote to memory of 2684 2568 wuauolts.exe 38 PID 2568 wrote to memory of 2684 2568 wuauolts.exe 38 PID 2568 wrote to memory of 2684 2568 wuauolts.exe 38 PID 2568 wrote to memory of 2684 2568 wuauolts.exe 38 PID 2684 wrote to memory of 2196 2684 wuauolts.exe 39 PID 2684 wrote to memory of 2196 2684 wuauolts.exe 39 PID 2684 wrote to memory of 2196 2684 wuauolts.exe 39 PID 2684 wrote to memory of 2196 2684 wuauolts.exe 39 PID 2196 wrote to memory of 2012 2196 wuauolts.exe 40 PID 2196 wrote to memory of 2012 2196 wuauolts.exe 40 PID 2196 wrote to memory of 2012 2196 wuauolts.exe 40 PID 2196 wrote to memory of 2012 2196 wuauolts.exe 40 PID 2012 wrote to memory of 1580 2012 wuauolts.exe 41 PID 2012 wrote to memory of 1580 2012 wuauolts.exe 41 PID 2012 wrote to memory of 1580 2012 wuauolts.exe 41 PID 2012 wrote to memory of 1580 2012 wuauolts.exe 41 PID 1580 wrote to memory of 2880 1580 wuauolts.exe 42 PID 1580 wrote to memory of 2880 1580 wuauolts.exe 42 PID 1580 wrote to memory of 2880 1580 wuauolts.exe 42 PID 1580 wrote to memory of 2880 1580 wuauolts.exe 42 PID 2880 wrote to memory of 2936 2880 wuauolts.exe 43 PID 2880 wrote to memory of 2936 2880 wuauolts.exe 43 PID 2880 wrote to memory of 2936 2880 wuauolts.exe 43 PID 2880 wrote to memory of 2936 2880 wuauolts.exe 43 PID 2936 wrote to memory of 2312 2936 wuauolts.exe 44 PID 2936 wrote to memory of 2312 2936 wuauolts.exe 44 PID 2936 wrote to memory of 2312 2936 wuauolts.exe 44 PID 2936 wrote to memory of 2312 2936 wuauolts.exe 44 PID 2312 wrote to memory of 1000 2312 wuauolts.exe 45 PID 2312 wrote to memory of 1000 2312 wuauolts.exe 45 PID 2312 wrote to memory of 1000 2312 wuauolts.exe 45 PID 2312 wrote to memory of 1000 2312 wuauolts.exe 45 PID 1000 wrote to memory of 668 1000 wuauolts.exe 46 PID 1000 wrote to memory of 668 1000 wuauolts.exe 46 PID 1000 wrote to memory of 668 1000 wuauolts.exe 46 PID 1000 wrote to memory of 668 1000 wuauolts.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\56150033.exe"C:\Users\Admin\AppData\Local\Temp\56150033.exe"1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe17⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:668 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe18⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2624 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe19⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2632 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe20⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1616 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe21⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1692 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe22⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2440 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2992 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe24⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2396 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe25⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1280 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe26⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2924 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe27⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1132 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe28⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2420 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe29⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2076 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe30⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:860 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe31⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1304 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe32⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2372 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe33⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1672 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe34⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1484 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe35⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1688 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe36⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1448 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe37⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1488 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe38⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3008 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe39⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1716 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe40⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1268 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe41⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1844 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe42⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1752 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe43⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2360 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe44⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2376 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe45⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1660 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe46⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:744 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe47⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2016 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe48⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2508 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe49⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2840 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe50⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:840 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe51⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2260 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe52⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2712 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe53⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1544 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe54⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2816 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe55⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2776 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe56⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2588 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe57⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1120 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe58⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2580 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe59⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1876 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe60⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2784 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe61⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2980 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe62⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1944 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe63⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2820 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe64⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2800 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe65⤵
- Executes dropped EXE
PID:680 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe66⤵PID:1932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe67⤵PID:1500
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe68⤵PID:2432
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe69⤵PID:1936
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe70⤵PID:1020
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe71⤵PID:2996
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe72⤵PID:692
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe73⤵PID:1052
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe74⤵PID:2228
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe75⤵PID:1192
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe76⤵PID:1804
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe77⤵
- Drops file in System32 directory
PID:2268 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe78⤵PID:340
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe79⤵PID:2356
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe80⤵PID:1960
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe81⤵PID:2672
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe82⤵PID:1728
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe83⤵PID:2584
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe84⤵PID:2636
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe85⤵PID:2596
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe86⤵PID:2708
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe87⤵PID:2020
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe88⤵PID:1372
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe89⤵PID:2388
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe90⤵PID:3060
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe91⤵PID:1892
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe92⤵PID:2088
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe93⤵PID:2876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe94⤵PID:932
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe95⤵PID:1480
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe96⤵PID:1552
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe97⤵
- Enumerates connected drives
PID:2024 -
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe98⤵PID:1964
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe99⤵PID:1760
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe100⤵PID:2964
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe101⤵PID:2096
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe102⤵PID:2680
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe103⤵PID:2540
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe104⤵PID:876
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe105⤵PID:2172
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe106⤵PID:2080
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe107⤵PID:2084
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe108⤵PID:1464
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe109⤵PID:1376
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe110⤵PID:2124
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe111⤵PID:2176
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe112⤵PID:3088
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe113⤵PID:3104
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe114⤵PID:3120
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe115⤵PID:3136
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe116⤵PID:3152
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe117⤵PID:3168
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe118⤵PID:3184
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe119⤵PID:3200
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe120⤵PID:3216
-
C:\Windows\SysWOW64\wuauolts.exeC:\Windows\system32\wuauolts.exe121⤵PID:3232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-