Task Manager shows a process named “svch0st.exe” (with a zero) running from a user's AppData\Temp folder. Why is this suspicious?

Le Gestionnaire des tâches montre un processus nommé « svch0st.exe » (avec un zéro) qui s'exécute depuis le dossier AppData\Temp d'un utilisateur. Pourquoi est-ce suspect ?

Answers

AIt is the normal Windows service host processC'est le processus hôte de services normal de Windows

BWindows keeps its core system files in Temp foldersWindows garde ses fichiers système essentiels dans les dossiers Temp

CProcess names containing digits are always updatesLes noms de processus contenant des chiffres sont toujours des mises à jour

DIt mimics svchost.exe, which lives in System32Il imite svchost.exe, qui se trouve dans System32

The answer and explanation are in the full bank.

This question is one of 2,831 in the paid banks. Each comes with the correct answer and the reasoning behind it, not just a mark.

Unlock for 5,000 RWF

MIFOTRA exam practicealigned to Practice set: Malware·3 marks·Hard

Task Manager shows a process named “svch0st.exe” (with a zero) running from a user's AppData\Temp folder. Why is this suspicious?

More Cybersecurity questions