Child processes link staged executables to logon launch settings
A Windows executable created several files in a temporary directory, and the process tree shows that some ran as children. One child wrote a Run-key value pointing to a different executable path, connecting the staged files to a persistence-related change without proving that a later logon activated it.
An executable running as software.exe created several other executables in a Windows temporary directory. The process tree placed some of those files directly beneath it, while a registry event identified one child setting a Windows-directory executable as a logon launch target. The question is not simply why so many filenames surround this sample, but what connects their roles: which files were staged, which ran, and which configured another path to run later?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read