Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
10/12/2024, 04:34
Behavioral task
behavioral1
Sample
HKP098767890HJ.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
HKP098767890HJ.exe
Resource
win10v2004-20241007-en
General
-
Target
HKP098767890HJ.exe
-
Size
813KB
-
MD5
d6b16370cd4e60185aa88607316a0c05
-
SHA1
7fbc63b1203617c67e5491745beaedb424baed78
-
SHA256
a6d6d1c8299f97f966d72373e999b5a8e6768914e27d5533307cf6878b95dce2
-
SHA512
16c468948e568343ab1a1460d82b4c5859d09043e3a0115aa9c0aefeabfa22c796cca505ede8b1f194764dda7c5263979230e3fa272ee1fb3b21919202b01906
-
SSDEEP
24576:Erl6kD68JmlotQfXTwzecW/wCyFbxXdRC:yl328U2yfdcZFFd
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\outvaunts.vbs outvaunts.exe -
Executes dropped EXE 64 IoCs
pid Process 2340 outvaunts.exe 2248 outvaunts.exe 2820 outvaunts.exe 2724 outvaunts.exe 2672 outvaunts.exe 3028 outvaunts.exe 1792 outvaunts.exe 2312 outvaunts.exe 1284 outvaunts.exe 2872 outvaunts.exe 2240 outvaunts.exe 2864 outvaunts.exe 1056 outvaunts.exe 640 outvaunts.exe 1356 outvaunts.exe 1736 outvaunts.exe 2448 outvaunts.exe 784 outvaunts.exe 1612 outvaunts.exe 2372 outvaunts.exe 2708 outvaunts.exe 2692 outvaunts.exe 2588 outvaunts.exe 2564 outvaunts.exe 840 outvaunts.exe 1040 outvaunts.exe 696 outvaunts.exe 768 outvaunts.exe 2620 outvaunts.exe 2656 outvaunts.exe 1108 outvaunts.exe 448 outvaunts.exe 876 outvaunts.exe 2088 outvaunts.exe 2968 outvaunts.exe 2292 outvaunts.exe 1964 outvaunts.exe 2296 outvaunts.exe 2528 outvaunts.exe 2328 outvaunts.exe 2056 outvaunts.exe 2952 outvaunts.exe 2764 outvaunts.exe 2828 outvaunts.exe 2608 outvaunts.exe 2592 outvaunts.exe 1744 outvaunts.exe 1288 outvaunts.exe 2648 outvaunts.exe 2916 outvaunts.exe 1796 outvaunts.exe 828 outvaunts.exe 1532 outvaunts.exe 2300 outvaunts.exe 2396 outvaunts.exe 2076 outvaunts.exe 2524 outvaunts.exe 1608 outvaunts.exe 1576 outvaunts.exe 2228 outvaunts.exe 2568 outvaunts.exe 2748 outvaunts.exe 2636 outvaunts.exe 1400 outvaunts.exe -
Loads dropped DLL 1 IoCs
pid Process 2480 HKP098767890HJ.exe -
AutoIT Executable 64 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2480-18-0x0000000000F20000-0x00000000010E4000-memory.dmp autoit_exe behavioral1/memory/2340-40-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2248-41-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2248-58-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2820-59-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2820-76-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2724-92-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2672-93-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2672-109-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/3028-110-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1792-127-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/3028-126-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1792-143-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2312-145-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2312-161-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1284-178-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2872-179-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2872-195-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2240-196-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2240-212-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2864-213-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2864-229-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1056-246-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/640-247-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/640-263-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1356-279-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1736-280-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1736-296-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2448-297-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/784-314-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2448-313-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/784-330-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1612-331-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1612-347-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2372-348-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2708-365-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2372-364-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2708-379-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2692-393-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2588-394-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2588-407-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2564-420-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/840-433-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1040-446-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/696-447-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/696-460-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/768-473-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2620-474-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2620-487-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2656-501-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1108-514-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/448-527-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/876-541-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2088-542-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2968-556-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2088-555-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2968-569-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2292-582-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/1964-596-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2296-600-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2528-601-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2528-614-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2328-628-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe behavioral1/memory/2056-642-0x00000000002F0000-0x00000000004B4000-memory.dmp autoit_exe -
resource yara_rule behavioral1/memory/2480-0-0x0000000000F20000-0x00000000010E4000-memory.dmp upx behavioral1/files/0x0008000000016d49-14.dat upx behavioral1/memory/2340-21-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2480-18-0x0000000000F20000-0x00000000010E4000-memory.dmp upx behavioral1/memory/2340-40-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2248-41-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2248-58-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2820-59-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2820-76-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2724-75-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2724-92-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2672-93-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2672-109-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/3028-110-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1792-127-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/3028-126-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1792-143-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2312-145-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1284-162-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2312-161-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1284-178-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2872-179-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2872-195-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2240-196-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2240-212-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2864-213-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1056-230-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2864-229-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1056-246-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/640-247-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/640-263-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1356-279-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1736-280-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1736-296-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2448-297-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/784-314-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2448-313-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/784-330-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1612-331-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1612-347-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2372-348-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2708-365-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2372-364-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2708-379-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2692-380-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2692-393-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2588-394-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2588-407-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/840-421-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2564-420-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/840-433-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1040-446-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/696-447-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/696-460-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/768-473-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2620-474-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2656-488-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2620-487-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/2656-501-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/1108-514-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/448-515-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/876-528-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/448-527-0x00000000002F0000-0x00000000004B4000-memory.dmp upx behavioral1/memory/876-541-0x00000000002F0000-0x00000000004B4000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language outvaunts.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2480 HKP098767890HJ.exe 2480 HKP098767890HJ.exe 2340 outvaunts.exe 2340 outvaunts.exe 2248 outvaunts.exe 2248 outvaunts.exe 2820 outvaunts.exe 2820 outvaunts.exe 2724 outvaunts.exe 2724 outvaunts.exe 2672 outvaunts.exe 2672 outvaunts.exe 3028 outvaunts.exe 3028 outvaunts.exe 1792 outvaunts.exe 1792 outvaunts.exe 2312 outvaunts.exe 2312 outvaunts.exe 1284 outvaunts.exe 1284 outvaunts.exe 2872 outvaunts.exe 2872 outvaunts.exe 2240 outvaunts.exe 2240 outvaunts.exe 2864 outvaunts.exe 2864 outvaunts.exe 1056 outvaunts.exe 1056 outvaunts.exe 640 outvaunts.exe 640 outvaunts.exe 1356 outvaunts.exe 1356 outvaunts.exe 1736 outvaunts.exe 1736 outvaunts.exe 2448 outvaunts.exe 2448 outvaunts.exe 784 outvaunts.exe 784 outvaunts.exe 1612 outvaunts.exe 1612 outvaunts.exe 2372 outvaunts.exe 2372 outvaunts.exe 2708 outvaunts.exe 2708 outvaunts.exe 2692 outvaunts.exe 2692 outvaunts.exe 2588 outvaunts.exe 2588 outvaunts.exe 2564 outvaunts.exe 2564 outvaunts.exe 840 outvaunts.exe 840 outvaunts.exe 1040 outvaunts.exe 1040 outvaunts.exe 696 outvaunts.exe 696 outvaunts.exe 768 outvaunts.exe 768 outvaunts.exe 2620 outvaunts.exe 2620 outvaunts.exe 2656 outvaunts.exe 2656 outvaunts.exe 1108 outvaunts.exe 1108 outvaunts.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2480 HKP098767890HJ.exe 2480 HKP098767890HJ.exe 2340 outvaunts.exe 2340 outvaunts.exe 2248 outvaunts.exe 2248 outvaunts.exe 2820 outvaunts.exe 2820 outvaunts.exe 2724 outvaunts.exe 2724 outvaunts.exe 2672 outvaunts.exe 2672 outvaunts.exe 3028 outvaunts.exe 3028 outvaunts.exe 1792 outvaunts.exe 1792 outvaunts.exe 2312 outvaunts.exe 2312 outvaunts.exe 1284 outvaunts.exe 1284 outvaunts.exe 2872 outvaunts.exe 2872 outvaunts.exe 2240 outvaunts.exe 2240 outvaunts.exe 2864 outvaunts.exe 2864 outvaunts.exe 1056 outvaunts.exe 1056 outvaunts.exe 640 outvaunts.exe 640 outvaunts.exe 1356 outvaunts.exe 1356 outvaunts.exe 1736 outvaunts.exe 1736 outvaunts.exe 2448 outvaunts.exe 2448 outvaunts.exe 784 outvaunts.exe 784 outvaunts.exe 1612 outvaunts.exe 1612 outvaunts.exe 2372 outvaunts.exe 2372 outvaunts.exe 2708 outvaunts.exe 2708 outvaunts.exe 2692 outvaunts.exe 2692 outvaunts.exe 2588 outvaunts.exe 2588 outvaunts.exe 2564 outvaunts.exe 2564 outvaunts.exe 840 outvaunts.exe 840 outvaunts.exe 1040 outvaunts.exe 1040 outvaunts.exe 696 outvaunts.exe 696 outvaunts.exe 768 outvaunts.exe 768 outvaunts.exe 2620 outvaunts.exe 2620 outvaunts.exe 2656 outvaunts.exe 2656 outvaunts.exe 1108 outvaunts.exe 1108 outvaunts.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2480 wrote to memory of 2340 2480 HKP098767890HJ.exe 30 PID 2480 wrote to memory of 2340 2480 HKP098767890HJ.exe 30 PID 2480 wrote to memory of 2340 2480 HKP098767890HJ.exe 30 PID 2480 wrote to memory of 2340 2480 HKP098767890HJ.exe 30 PID 2340 wrote to memory of 2248 2340 outvaunts.exe 31 PID 2340 wrote to memory of 2248 2340 outvaunts.exe 31 PID 2340 wrote to memory of 2248 2340 outvaunts.exe 31 PID 2340 wrote to memory of 2248 2340 outvaunts.exe 31 PID 2248 wrote to memory of 2820 2248 outvaunts.exe 32 PID 2248 wrote to memory of 2820 2248 outvaunts.exe 32 PID 2248 wrote to memory of 2820 2248 outvaunts.exe 32 PID 2248 wrote to memory of 2820 2248 outvaunts.exe 32 PID 2820 wrote to memory of 2724 2820 outvaunts.exe 33 PID 2820 wrote to memory of 2724 2820 outvaunts.exe 33 PID 2820 wrote to memory of 2724 2820 outvaunts.exe 33 PID 2820 wrote to memory of 2724 2820 outvaunts.exe 33 PID 2724 wrote to memory of 2672 2724 outvaunts.exe 34 PID 2724 wrote to memory of 2672 2724 outvaunts.exe 34 PID 2724 wrote to memory of 2672 2724 outvaunts.exe 34 PID 2724 wrote to memory of 2672 2724 outvaunts.exe 34 PID 2672 wrote to memory of 3028 2672 outvaunts.exe 35 PID 2672 wrote to memory of 3028 2672 outvaunts.exe 35 PID 2672 wrote to memory of 3028 2672 outvaunts.exe 35 PID 2672 wrote to memory of 3028 2672 outvaunts.exe 35 PID 3028 wrote to memory of 1792 3028 outvaunts.exe 36 PID 3028 wrote to memory of 1792 3028 outvaunts.exe 36 PID 3028 wrote to memory of 1792 3028 outvaunts.exe 36 PID 3028 wrote to memory of 1792 3028 outvaunts.exe 36 PID 1792 wrote to memory of 2312 1792 outvaunts.exe 37 PID 1792 wrote to memory of 2312 1792 outvaunts.exe 37 PID 1792 wrote to memory of 2312 1792 outvaunts.exe 37 PID 1792 wrote to memory of 2312 1792 outvaunts.exe 37 PID 2312 wrote to memory of 1284 2312 outvaunts.exe 38 PID 2312 wrote to memory of 1284 2312 outvaunts.exe 38 PID 2312 wrote to memory of 1284 2312 outvaunts.exe 38 PID 2312 wrote to memory of 1284 2312 outvaunts.exe 38 PID 1284 wrote to memory of 2872 1284 outvaunts.exe 39 PID 1284 wrote to memory of 2872 1284 outvaunts.exe 39 PID 1284 wrote to memory of 2872 1284 outvaunts.exe 39 PID 1284 wrote to memory of 2872 1284 outvaunts.exe 39 PID 2872 wrote to memory of 2240 2872 outvaunts.exe 41 PID 2872 wrote to memory of 2240 2872 outvaunts.exe 41 PID 2872 wrote to memory of 2240 2872 outvaunts.exe 41 PID 2872 wrote to memory of 2240 2872 outvaunts.exe 41 PID 2240 wrote to memory of 2864 2240 outvaunts.exe 42 PID 2240 wrote to memory of 2864 2240 outvaunts.exe 42 PID 2240 wrote to memory of 2864 2240 outvaunts.exe 42 PID 2240 wrote to memory of 2864 2240 outvaunts.exe 42 PID 2864 wrote to memory of 1056 2864 outvaunts.exe 43 PID 2864 wrote to memory of 1056 2864 outvaunts.exe 43 PID 2864 wrote to memory of 1056 2864 outvaunts.exe 43 PID 2864 wrote to memory of 1056 2864 outvaunts.exe 43 PID 1056 wrote to memory of 640 1056 outvaunts.exe 44 PID 1056 wrote to memory of 640 1056 outvaunts.exe 44 PID 1056 wrote to memory of 640 1056 outvaunts.exe 44 PID 1056 wrote to memory of 640 1056 outvaunts.exe 44 PID 640 wrote to memory of 1356 640 outvaunts.exe 45 PID 640 wrote to memory of 1356 640 outvaunts.exe 45 PID 640 wrote to memory of 1356 640 outvaunts.exe 45 PID 640 wrote to memory of 1356 640 outvaunts.exe 45 PID 1356 wrote to memory of 1736 1356 outvaunts.exe 46 PID 1356 wrote to memory of 1736 1356 outvaunts.exe 46 PID 1356 wrote to memory of 1736 1356 outvaunts.exe 46 PID 1356 wrote to memory of 1736 1356 outvaunts.exe 46
Processes
-
C:\Users\Admin\AppData\Local\Temp\HKP098767890HJ.exe"C:\Users\Admin\AppData\Local\Temp\HKP098767890HJ.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\Temp\HKP098767890HJ.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"9⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"10⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"11⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"12⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"13⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"14⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"15⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"17⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1736 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"18⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2448 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"19⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:784 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"20⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1612 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"21⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2372 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"22⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2708 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"23⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2692 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"24⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2588 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"25⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2564 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"26⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:840 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"27⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1040 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"28⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:696 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"29⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:768 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"30⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2620 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"31⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2656 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"32⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1108 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"33⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"34⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"35⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"36⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2968 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"37⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2292 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"38⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"39⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"40⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"41⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2328 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"42⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"43⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"44⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"45⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"46⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"47⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2592 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"48⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"49⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"50⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2648 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"51⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"52⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:828 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"54⤵
- Executes dropped EXE
PID:1532 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"55⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2300 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"56⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"57⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"58⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"59⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1608 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"60⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"61⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2228 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"62⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"63⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"64⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2636 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"65⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"66⤵
- System Location Discovery: System Language Discovery
PID:860 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"67⤵
- System Location Discovery: System Language Discovery
PID:500 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"68⤵
- System Location Discovery: System Language Discovery
PID:1488 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"69⤵PID:2740
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"70⤵PID:2896
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"71⤵PID:1772
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"72⤵PID:2364
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"73⤵PID:1852
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"74⤵
- System Location Discovery: System Language Discovery
PID:1820 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"75⤵PID:2440
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"76⤵PID:2932
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"77⤵PID:2052
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"78⤵PID:2516
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"79⤵PID:1712
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"80⤵PID:2852
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"81⤵PID:2616
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"82⤵PID:2604
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"83⤵PID:3032
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"84⤵PID:1320
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"85⤵PID:2304
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"86⤵
- System Location Discovery: System Language Discovery
PID:1688 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"87⤵PID:2600
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"88⤵PID:1892
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"89⤵PID:1720
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"90⤵PID:1640
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"91⤵PID:2244
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"92⤵
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"93⤵PID:2348
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"94⤵PID:2836
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"95⤵
- System Location Discovery: System Language Discovery
PID:2744 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"96⤵PID:2676
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"97⤵
- System Location Discovery: System Language Discovery
PID:2700 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"98⤵PID:2092
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"99⤵PID:2384
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"100⤵PID:1692
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"101⤵PID:2888
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"102⤵PID:1740
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"103⤵PID:1660
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"104⤵PID:1324
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"105⤵PID:2144
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"106⤵PID:1508
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"107⤵PID:320
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"108⤵
- System Location Discovery: System Language Discovery
PID:1996 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"109⤵PID:2712
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"110⤵PID:2728
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"111⤵PID:2232
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"112⤵PID:2476
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"113⤵PID:1936
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"114⤵PID:2064
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"115⤵
- System Location Discovery: System Language Discovery
PID:1304 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"116⤵PID:2032
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"117⤵PID:1036
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"118⤵PID:3068
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"119⤵
- System Location Discovery: System Language Discovery
PID:884 -
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"120⤵PID:2024
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"121⤵PID:1748
-
C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"C:\Users\Admin\AppData\Local\complacence\outvaunts.exe"122⤵PID:2908
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-