37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17cc

Analysis

max time kernel
119s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe
Size

184KB
MD5

2b8271ee4b1e7a51441515ec6f243640
SHA1

fa16729c43ef355093398d2f14b0e1764f04fbaf
SHA256

37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17cc
SHA512

ecb98434e347fbb2fc8b4121ca3a886b70df9df2ca4f756eaafc8e9a2f91aa344a4bf696200594abbc5fc8127488dbb1f285ce3e7a15ccadc9918c0ff30d5305
SSDEEP

3072:umRBJ8o2IjH4Z+VyrjJ8SCRVlvnqXqGuy:umuojA+VG8xRVlPqXqGu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4384	Temp53232.exe
4484	Local18204.exe
3676	Temp33148.exe
368	AppData56112.exe
1652	Local40330.exe
4532	Local2827.exe
3364	Temp31507.exe
2768	Admin7871.exe
3152	AppData61711.exe
3592	AppData20892.exe
1488	AppData59786.exe
2496	Local59786.exe
1760	Local31097.exe
4640	Temp36963.exe
5012	Local39920.exe
4108	Users57238.exe
1804	Admin14814.exe
4468	Admin12121.exe
4676	Admin16206.exe
224	AppData43402.exe
548	AppData57138.exe
468	Admin40710.exe
1836	AppData29012.exe
2504	AppData30404.exe
4808	AppData42656.exe
2452	Local36526.exe
800	AppData50824.exe
4932	Local54643.exe
5092	Local39126.exe
844	Temp54146.exe
1964	Local54908.exe
640	31520.exe
3000	Users32650.exe
4536	Users52516.exe
4048	Admin1269.exe
3124	Users1177.exe
4948	Users9345.exe
4084	Admin32458.exe
4184	Admin5816.exe
1324	Admin40456.exe
2144	Admin13813.exe
1632	AppData50662.exe
1880	AppData60611.exe
4136	Admin3507.exe
980	AppData53376.exe
1868	Users59506.exe
3896	Admin17082.exe
3420	Admin26642.exe
2408	AppData61452.exe
1796	Admin34810.exe
716	AppData16336.exe
1656	Local8167.exe
4708	AppData16336.exe
4944	Local15573.exe
4504	Temp3122.exe
2236	Local16890.exe
2772	Local36491.exe
5024	AppData24504.exe
3368	Local30625.exe
4628	AppData4638.exe
2272	16912.exe
4140	35940.exe
1240	AppData25634.exe
2828	Users17274.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1644	2504	WerFault.exe	121
15652	7120	WerFault.exe	296
7540	8528	WerFault.exe	380

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users58302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users30825.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppData41385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users62241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppData65147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	47716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users54592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users53576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin5816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	15483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin47930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7325.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	59999.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users11643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users34229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin18416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin33392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin40710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Local36491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin9848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin42126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin46018.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin4319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users2666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	62459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin23682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users4275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users22112.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48043.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users1529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users32650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin46848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users23932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin18416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin38540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users6351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Local15573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users23433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users3071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users6470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users18416.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users59370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin59448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users37692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users42288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppData7443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users24094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppData11794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Local29403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Users7175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin19977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Admin18329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AppData4825.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe
4384	Temp53232.exe
4484	Local18204.exe
3676	Temp33148.exe
368	AppData56112.exe
4532	Local2827.exe
1652	Local40330.exe
3364	Temp31507.exe
2768	Admin7871.exe
3152	AppData61711.exe
3592	AppData20892.exe
1488	AppData59786.exe
5012	Local39920.exe
2496	Local59786.exe
4640	Temp36963.exe
1760	Local31097.exe
4108	Users57238.exe
1804	Admin14814.exe
4468	Admin12121.exe
4676	Admin16206.exe
224	AppData43402.exe
548	AppData57138.exe
1836	AppData29012.exe
468	Admin40710.exe
2504	AppData30404.exe
4808	AppData42656.exe
844	Temp54146.exe
4932	Local54643.exe
5092	Local39126.exe
800	AppData50824.exe
1964	Local54908.exe
2452	Local36526.exe
640	31520.exe
3000	Users32650.exe
4536	Users52516.exe
4048	Admin1269.exe
4948	Users9345.exe
4084	Admin32458.exe
4184	Admin5816.exe
1324	Admin40456.exe
2144	Admin13813.exe
1632	AppData50662.exe
1880	AppData60611.exe
4136	Admin3507.exe
1868	Users59506.exe
980	AppData53376.exe
3896	Admin17082.exe
3420	Admin26642.exe
2408	AppData61452.exe
1656	Local8167.exe
1796	Admin34810.exe
4708	AppData16336.exe
716	AppData16336.exe
4944	Local15573.exe
4504	Temp3122.exe
2772	Local36491.exe
5024	AppData24504.exe
2236	Local16890.exe
3368	Local30625.exe
4140	35940.exe
2272	16912.exe
4628	AppData4638.exe
1240	AppData25634.exe
740	10497.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 4384	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	87
PID 644 wrote to memory of 4384	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	87
PID 644 wrote to memory of 4384	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	87
PID 4384 wrote to memory of 4484	4384	Temp53232.exe	91
PID 4384 wrote to memory of 4484	4384	Temp53232.exe	91
PID 4384 wrote to memory of 4484	4384	Temp53232.exe	91
PID 644 wrote to memory of 3676	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	92
PID 644 wrote to memory of 3676	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	92
PID 644 wrote to memory of 3676	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	92
PID 4484 wrote to memory of 368	4484	Local18204.exe	97
PID 4484 wrote to memory of 368	4484	Local18204.exe	97
PID 4484 wrote to memory of 368	4484	Local18204.exe	97
PID 4384 wrote to memory of 1652	4384	Temp53232.exe	98
PID 4384 wrote to memory of 1652	4384	Temp53232.exe	98
PID 4384 wrote to memory of 1652	4384	Temp53232.exe	98
PID 3676 wrote to memory of 4532	3676	Temp33148.exe	99
PID 3676 wrote to memory of 4532	3676	Temp33148.exe	99
PID 3676 wrote to memory of 4532	3676	Temp33148.exe	99
PID 644 wrote to memory of 3364	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	100
PID 644 wrote to memory of 3364	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	100
PID 644 wrote to memory of 3364	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	100
PID 368 wrote to memory of 2768	368	AppData56112.exe	105
PID 368 wrote to memory of 2768	368	AppData56112.exe	105
PID 368 wrote to memory of 2768	368	AppData56112.exe	105
PID 4484 wrote to memory of 3152	4484	Local18204.exe	106
PID 4484 wrote to memory of 3152	4484	Local18204.exe	106
PID 4484 wrote to memory of 3152	4484	Local18204.exe	106
PID 4532 wrote to memory of 3592	4532	Local2827.exe	107
PID 4532 wrote to memory of 3592	4532	Local2827.exe	107
PID 4532 wrote to memory of 3592	4532	Local2827.exe	107
PID 1652 wrote to memory of 1488	1652	Local40330.exe	108
PID 1652 wrote to memory of 1488	1652	Local40330.exe	108
PID 1652 wrote to memory of 1488	1652	Local40330.exe	108
PID 3364 wrote to memory of 2496	3364	Temp31507.exe	109
PID 3364 wrote to memory of 2496	3364	Temp31507.exe	109
PID 3364 wrote to memory of 2496	3364	Temp31507.exe	109
PID 4384 wrote to memory of 1760	4384	Temp53232.exe	111
PID 4384 wrote to memory of 1760	4384	Temp53232.exe	111
PID 4384 wrote to memory of 1760	4384	Temp53232.exe	111
PID 644 wrote to memory of 4640	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	110
PID 644 wrote to memory of 4640	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	110
PID 644 wrote to memory of 4640	644	37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe	110
PID 3676 wrote to memory of 5012	3676	Temp33148.exe	112
PID 3676 wrote to memory of 5012	3676	Temp33148.exe	112
PID 3676 wrote to memory of 5012	3676	Temp33148.exe	112
PID 2768 wrote to memory of 4108	2768	Admin7871.exe	113
PID 2768 wrote to memory of 4108	2768	Admin7871.exe	113
PID 2768 wrote to memory of 4108	2768	Admin7871.exe	113
PID 368 wrote to memory of 1804	368	AppData56112.exe	114
PID 368 wrote to memory of 1804	368	AppData56112.exe	114
PID 368 wrote to memory of 1804	368	AppData56112.exe	114
PID 3152 wrote to memory of 4468	3152	AppData61711.exe	115
PID 3152 wrote to memory of 4468	3152	AppData61711.exe	115
PID 3152 wrote to memory of 4468	3152	AppData61711.exe	115
PID 3592 wrote to memory of 4676	3592	AppData20892.exe	116
PID 3592 wrote to memory of 4676	3592	AppData20892.exe	116
PID 3592 wrote to memory of 4676	3592	AppData20892.exe	116
PID 4532 wrote to memory of 224	4532	Local2827.exe	117
PID 4532 wrote to memory of 224	4532	Local2827.exe	117
PID 4532 wrote to memory of 224	4532	Local2827.exe	117
PID 4484 wrote to memory of 548	4484	Local18204.exe	118
PID 4484 wrote to memory of 548	4484	Local18204.exe	118
PID 4484 wrote to memory of 548	4484	Local18204.exe	118
PID 1488 wrote to memory of 468	1488	AppData59786.exe	119

C:\Users\Admin\AppData\Local\Temp\37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe
"C:\Users\Admin\AppData\Local\Temp\37afb290a2990730bb9501a80035a620d8934daafc2dcd969dec205aa73d17ccN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp53232.exe
  C:\Users\Admin\AppData\Local\Temp53232.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Users\Admin\AppData\Local18204.exe
    C:\Users\Admin\AppData\Local18204.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4484
  - - C:\Users\Admin\AppData56112.exe
      C:\Users\Admin\AppData56112.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:368
    - - C:\Users\Admin7871.exe
        
        C:\Users\Admin7871.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2768
      - C:\Users57238.exe
        
        C:\Users57238.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
        
        C:\31520.exe
        
        C:\31520.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:640
        
        C:\16912.exe
        
        C:\16912.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\29714.exe
        
        C:\29714.exe
        9⤵
        
        PID:5288
        
        C:\40804.exe
        
        C:\40804.exe
        10⤵
        
        PID:10012
        
        C:\43574.exe
        
        C:\43574.exe
        10⤵
        
        PID:12508
        
        C:\39848.exe
        
        C:\39848.exe
        10⤵
        
        PID:6048
        
        C:\8441.exe
        
        C:\8441.exe
        9⤵
        
        PID:4612
        
        C:\4270.exe
        
        C:\4270.exe
        9⤵
        
        PID:12468
        
        C:\33155.exe
        
        C:\33155.exe
        9⤵
        
        PID:15800
        
        C:\34928.exe
        
        C:\34928.exe
        8⤵
        
        PID:5940
        
        C:\1566.exe
        
        C:\1566.exe
        9⤵
        
        PID:8348
        
        C:\6443.exe
        
        C:\6443.exe
        9⤵
        
        PID:11716
        
        C:\37161.exe
        
        C:\37161.exe
        9⤵
        
        PID:15776
        
        C:\44658.exe
        
        C:\44658.exe
        9⤵
        
        PID:1128
        
        C:\39614.exe
        
        C:\39614.exe
        8⤵
        
        PID:4776
        
        C:\24177.exe
        
        C:\24177.exe
        8⤵
        
        PID:10412
        
        C:\25319.exe
        
        C:\25319.exe
        8⤵
        
        PID:14324
        
        C:\60367.exe
        
        C:\60367.exe
        8⤵
        
        PID:6204
        
        C:\35940.exe
        
        C:\35940.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4140
        
        C:\39636.exe
        
        C:\39636.exe
        8⤵
        
        PID:5788
        
        C:\11343.exe
        
        C:\11343.exe
        9⤵
        
        PID:7644
        
        C:\978.exe
        
        C:\978.exe
        10⤵
        
        PID:7344
        
        C:\4986.exe
        
        C:\4986.exe
        9⤵
        
        PID:9428
        
        C:\44416.exe
        
        C:\44416.exe
        10⤵
        
        PID:16820
        
        C:\59448.exe
        
        C:\59448.exe
        9⤵
        
        PID:12352
        
        C:\45713.exe
        
        C:\45713.exe
        9⤵
        
        PID:6268
        
        C:\14804.exe
        
        C:\14804.exe
        8⤵
        
        PID:7936
        
        C:\25711.exe
        
        C:\25711.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9936
        
        C:\8904.exe
        
        C:\8904.exe
        8⤵
        
        PID:4220
        
        C:\25563.exe
        
        C:\25563.exe
        8⤵
        
        PID:16416
        
        C:\31751.exe
        
        C:\31751.exe
        7⤵
        
        PID:5480
        
        C:\46922.exe
        
        C:\46922.exe
        8⤵
        
        PID:8032
        
        C:\59999.exe
        
        C:\59999.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11232
        
        C:\46018.exe
        
        C:\46018.exe
        8⤵
        
        PID:14492
        
        C:\56595.exe
        
        C:\56595.exe
        8⤵
        
        PID:2428
        
        C:\2116.exe
        
        C:\2116.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5808
        
        C:\30669.exe
        
        C:\30669.exe
        7⤵
        
        PID:12152
        
        C:\37756.exe
        
        C:\37756.exe
        7⤵
        
        PID:14696
        
        C:\52544.exe
        
        C:\52544.exe
        7⤵
        
        PID:6312
      - C:\Users32650.exe
        
        C:\Users32650.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3000
        
        C:\6413.exe
        
        C:\6413.exe
        7⤵
        
        PID:3744
        
        C:\29714.exe
        
        C:\29714.exe
        8⤵
        
        PID:5204
        
        C:\14571.exe
        
        C:\14571.exe
        9⤵
        
        PID:8000
        
        C:\62459.exe
        
        C:\62459.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12460
        
        C:\50730.exe
        
        C:\50730.exe
        9⤵
        
        PID:4952
        
        C:\4882.exe
        
        C:\4882.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7316
        
        C:\38924.exe
        
        C:\38924.exe
        8⤵
        
        PID:11172
        
        C:\51883.exe
        
        C:\51883.exe
        8⤵
        
        PID:14412
        
        C:\64266.exe
        
        C:\64266.exe
        8⤵
        
        PID:6272
        
        C:\54773.exe
        
        C:\54773.exe
        7⤵
        
        PID:4600
        
        C:\1909.exe
        
        C:\1909.exe
        8⤵
        
        PID:10140
        
        C:\43574.exe
        
        C:\43574.exe
        8⤵
        
        PID:12420
        
        C:\39848.exe
        
        C:\39848.exe
        8⤵
        
        PID:4128
        
        C:\53812.exe
        
        C:\53812.exe
        7⤵
        
        PID:5068
        
        C:\58987.exe
        
        C:\58987.exe
        7⤵
        
        PID:10372
        
        C:\4098.exe
        
        C:\4098.exe
        7⤵
        
        PID:15932
        
        C:\8940.exe
        
        C:\8940.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17692
      - C:\Users12535.exe
        
        C:\Users12535.exe
        6⤵
        
        PID:2464
        
        C:\3071.exe
        
        C:\3071.exe
        7⤵
        
        PID:5444
        
        C:\16196.exe
        
        C:\16196.exe
        8⤵
        
        PID:8120
        
        C:\59999.exe
        
        C:\59999.exe
        8⤵
        
        PID:11216
        
        C:\51473.exe
        
        C:\51473.exe
        8⤵
        
        PID:15632
        
        C:\52206.exe
        
        C:\52206.exe
        8⤵
        
        PID:16992
        
        C:\23932.exe
        
        C:\23932.exe
        7⤵
        
        PID:432
        
        C:\8197.exe
        
        C:\8197.exe
        7⤵
        
        PID:11180
        
        C:\51883.exe
        
        C:\51883.exe
        7⤵
        
        PID:14348
        
        C:\25371.exe
        
        C:\25371.exe
        7⤵
        
        PID:6320
      - C:\Users31971.exe
        
        C:\Users31971.exe
        6⤵
        
        PID:6040
        
        C:\51006.exe
        
        C:\51006.exe
        7⤵
        
        PID:8128
        
        C:\59999.exe
        
        C:\59999.exe
        7⤵
        
        PID:11244
        
        C:\51473.exe
        
        C:\51473.exe
        7⤵
        
        PID:15600
        
        C:\41708.exe
        
        C:\41708.exe
        7⤵
        
        PID:15544
      - C:\Users20861.exe
        
        C:\Users20861.exe
        6⤵
        
        PID:8240
      - C:\Users19972.exe
        
        C:\Users19972.exe
        6⤵
        
        PID:11520
      - C:\Users25850.exe
        
        C:\Users25850.exe
        6⤵
        
        PID:15004
      - C:\Users35097.exe
        
        C:\Users35097.exe
        6⤵
        
        PID:5900
    - - C:\Users\Admin14814.exe
        
        C:\Users\Admin14814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
      - C:\Users52516.exe
        
        C:\Users52516.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4536
        
        C:\10497.exe
        
        C:\10497.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:740
        
        C:\64524.exe
        
        C:\64524.exe
        8⤵
        
        PID:5236
        
        C:\45054.exe
        
        C:\45054.exe
        9⤵
        
        PID:9756
        
        C:\32282.exe
        
        C:\32282.exe
        9⤵
        
        PID:13748
        
        C:\28363.exe
        
        C:\28363.exe
        9⤵
        
        PID:3372
        
        C:\48053.exe
        
        C:\48053.exe
        8⤵
        
        PID:5564
        
        C:\2324.exe
        
        C:\2324.exe
        8⤵
        
        PID:11964
        
        C:\25755.exe
        
        C:\25755.exe
        8⤵
        
        PID:17064
        
        C:\24046.exe
        
        C:\24046.exe
        7⤵
        
        PID:5780
        
        C:\4815.exe
        
        C:\4815.exe
        8⤵
        
        PID:10116
        
        C:\33652.exe
        
        C:\33652.exe
        8⤵
        
        PID:13524
        
        C:\30117.exe
        
        C:\30117.exe
        8⤵
        
        PID:6876
        
        C:\63926.exe
        
        C:\63926.exe
        7⤵
        
        PID:7764
        
        C:\45173.exe
        
        C:\45173.exe
        7⤵
        
        PID:11548
        
        C:\20626.exe
        
        C:\20626.exe
        7⤵
        
        PID:15752
        
        C:\37721.exe
        
        C:\37721.exe
        7⤵
        
        PID:16680
      - C:\Users2884.exe
        
        C:\Users2884.exe
        6⤵
        
        PID:4564
        
        C:\37606.exe
        
        C:\37606.exe
        7⤵
        
        PID:6868
        
        C:\3637.exe
        
        C:\3637.exe
        8⤵
        
        PID:10404
        
        C:\55033.exe
        
        C:\55033.exe
        8⤵
        
        PID:14040
        
        C:\63536.exe
        
        C:\63536.exe
        8⤵
        
        PID:17340
        
        C:\9017.exe
        
        C:\9017.exe
        7⤵
        
        PID:7816
        
        C:\27981.exe
        
        C:\27981.exe
        7⤵
        
        PID:12784
        
        C:\45743.exe
        
        C:\45743.exe
        7⤵
        
        PID:17904
      - C:\Users37782.exe
        
        C:\Users37782.exe
        6⤵
        
        PID:5828
        
        C:\64898.exe
        
        C:\64898.exe
        7⤵
        
        PID:10308
        
        C:\14384.exe
        
        C:\14384.exe
        7⤵
        
        PID:15140
        
        C:\14165.exe
        
        C:\14165.exe
        7⤵
        
        PID:16408
      - C:\Users4254.exe
        
        C:\Users4254.exe
        6⤵
        
        PID:7804
      - C:\Users56352.exe
        
        C:\Users56352.exe
        6⤵
        
        PID:11288
      - C:\Users43594.exe
        
        C:\Users43594.exe
        6⤵
        
        PID:15152
      - C:\Users13265.exe
        
        C:\Users13265.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin1269.exe
        
        C:\Users\Admin1269.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
      - C:\Users4275.exe
        
        C:\Users4275.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:384
        
        C:\64908.exe
        
        C:\64908.exe
        7⤵
        
        PID:5460
        
        C:\27374.exe
        
        C:\27374.exe
        8⤵
        
        PID:10156
        
        C:\21400.exe
        
        C:\21400.exe
        8⤵
        
        PID:13460
        
        C:\13781.exe
        
        C:\13781.exe
        8⤵
        
        PID:6120
        
        C:\59127.exe
        
        C:\59127.exe
        7⤵
        
        PID:8060
        
        C:\39308.exe
        
        C:\39308.exe
        7⤵
        
        PID:11532
        
        C:\33985.exe
        
        C:\33985.exe
        7⤵
        
        PID:15080
        
        C:\12735.exe
        
        C:\12735.exe
        7⤵
        
        PID:16752
      - C:\Users44851.exe
        
        C:\Users44851.exe
        6⤵
        
        PID:6252
        
        C:\20280.exe
        
        C:\20280.exe
        7⤵
        
        PID:8136
        
        C:\59999.exe
        
        C:\59999.exe
        7⤵
        
        PID:11224
        
        C:\51473.exe
        
        C:\51473.exe
        7⤵
        
        PID:15624
        
        C:\57803.exe
        
        C:\57803.exe
        7⤵
        
        PID:3412
      - C:\Users7325.exe
        
        C:\Users7325.exe
        6⤵
        
        PID:7860
      - C:\Users38017.exe
        
        C:\Users38017.exe
        6⤵
        
        PID:7856
      - C:\Users17177.exe
        
        C:\Users17177.exe
        6⤵
        
        PID:12848
      - C:\Users37040.exe
        
        C:\Users37040.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin29283.exe
        
        C:\Users\Admin29283.exe
        5⤵
        
        PID:3064
      - C:\Users3071.exe
        
        C:\Users3071.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5368
        
        C:\4815.exe
        
        C:\4815.exe
        7⤵
        
        PID:10132
        
        C:\48043.exe
        
        C:\48043.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13432
        
        C:\60844.exe
        
        C:\60844.exe
        7⤵
        
        PID:6476
      - C:\Users23932.exe
        
        C:\Users23932.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1368
      - C:\Users43008.exe
        
        C:\Users43008.exe
        6⤵
        
        PID:11152
      - C:\Users51883.exe
        
        C:\Users51883.exe
        6⤵
        
        PID:13724
      - C:\Users48314.exe
        
        C:\Users48314.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin15137.exe
        
        C:\Users\Admin15137.exe
        5⤵
        
        PID:5984
      - C:\Users21344.exe
        
        C:\Users21344.exe
        6⤵
        
        PID:9844
      - C:\Users49797.exe
        
        C:\Users49797.exe
        6⤵
        
        PID:12292
      - C:\Users19427.exe
        
        C:\Users19427.exe
        6⤵
        
        PID:4604
    - - C:\Users\Admin53527.exe
        
        C:\Users\Admin53527.exe
        5⤵
        
        PID:6952
    - - C:\Users\Admin37038.exe
        
        C:\Users\Admin37038.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin4319.exe
        
        C:\Users\Admin4319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15308
    - - C:\Users\Admin982.exe
        
        C:\Users\Admin982.exe
        5⤵
        
        PID:6628
  - - C:\Users\Admin\AppData61711.exe
      C:\Users\Admin\AppData61711.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3152
    - - C:\Users\Admin12121.exe
        
        C:\Users\Admin12121.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users1177.exe
        
        C:\Users1177.exe
        6⤵
        Executes dropped EXE
        
        PID:3124
      - C:\Users17274.exe
        
        C:\Users17274.exe
        6⤵
        Executes dropped EXE
        
        PID:2828
        
        C:\9101.exe
        
        C:\9101.exe
        7⤵
        
        PID:4920
        
        C:\44784.exe
        
        C:\44784.exe
        8⤵
        
        PID:7668
        
        C:\45417.exe
        
        C:\45417.exe
        8⤵
        
        PID:11308
        
        C:\32203.exe
        
        C:\32203.exe
        8⤵
        
        PID:13988
        
        C:\7394.exe
        
        C:\7394.exe
        8⤵
        
        PID:5184
        
        C:\4882.exe
        
        C:\4882.exe
        7⤵
        
        PID:7308
        
        C:\38924.exe
        
        C:\38924.exe
        7⤵
        
        PID:11056
        
        C:\51883.exe
        
        C:\51883.exe
        7⤵
        
        PID:14420
        
        C:\18957.exe
        
        C:\18957.exe
        7⤵
        
        PID:16728
      - C:\Users39728.exe
        
        C:\Users39728.exe
        6⤵
        
        PID:5860
        
        C:\61120.exe
        
        C:\61120.exe
        7⤵
        
        PID:6776
        
        C:\4576.exe
        
        C:\4576.exe
        7⤵
        
        PID:10352
        
        C:\15675.exe
        
        C:\15675.exe
        7⤵
        
        PID:14520
        
        C:\3694.exe
        
        C:\3694.exe
        7⤵
        
        PID:17192
      - C:\Users13190.exe
        
        C:\Users13190.exe
        6⤵
        
        PID:5352
      - C:\Users56352.exe
        
        C:\Users56352.exe
        6⤵
        
        PID:11324
      - C:\Users8784.exe
        
        C:\Users8784.exe
        6⤵
        
        PID:15132
      - C:\Users64796.exe
        
        C:\Users64796.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin32458.exe
        
        C:\Users\Admin32458.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4084
      - C:\Users55998.exe
        
        C:\Users55998.exe
        6⤵
        
        PID:2940
        
        C:\64524.exe
        
        C:\64524.exe
        7⤵
        
        PID:5244
        
        C:\12687.exe
        
        C:\12687.exe
        8⤵
        
        PID:6788
        
        C:\24804.exe
        
        C:\24804.exe
        8⤵
        
        PID:10332
        
        C:\10823.exe
        
        C:\10823.exe
        8⤵
        
        PID:13788
        
        C:\42619.exe
        
        C:\42619.exe
        8⤵
        
        PID:18352
        
        C:\13050.exe
        
        C:\13050.exe
        7⤵
        
        PID:2384
        
        C:\30755.exe
        
        C:\30755.exe
        7⤵
        
        PID:10924
        
        C:\21348.exe
        
        C:\21348.exe
        7⤵
        
        PID:14216
        
        C:\53768.exe
        
        C:\53768.exe
        7⤵
        
        PID:16796
      - C:\Users24046.exe
        
        C:\Users24046.exe
        6⤵
        
        PID:5660
        
        C:\64322.exe
        
        C:\64322.exe
        7⤵
        
        PID:9808
        
        C:\56211.exe
        
        C:\56211.exe
        7⤵
        
        PID:13480
        
        C:\13781.exe
        
        C:\13781.exe
        7⤵
        
        PID:15592
      - C:\Users12779.exe
        
        C:\Users12779.exe
        6⤵
        
        PID:7696
      - C:\Users65017.exe
        
        C:\Users65017.exe
        6⤵
        
        PID:11300
      - C:\Users60130.exe
        
        C:\Users60130.exe
        6⤵
        
        PID:14112
      - C:\Users35862.exe
        
        C:\Users35862.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin62120.exe
        
        C:\Users\Admin62120.exe
        5⤵
        
        PID:728
      - C:\Users7539.exe
        
        C:\Users7539.exe
        6⤵
        
        PID:5624
        
        C:\32226.exe
        
        C:\32226.exe
        7⤵
        
        PID:10496
        
        C:\55033.exe
        
        C:\55033.exe
        7⤵
        
        PID:14048
        
        C:\51284.exe
        
        C:\51284.exe
        7⤵
        
        PID:18376
      - C:\Users15126.exe
        
        C:\Users15126.exe
        6⤵
        
        PID:7944
      - C:\Users22909.exe
        
        C:\Users22909.exe
        6⤵
        
        PID:12592
      - C:\Users34229.exe
        
        C:\Users34229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16452
    - - C:\Users\Admin36787.exe
        
        C:\Users\Admin36787.exe
        5⤵
        
        PID:6820
      - C:\Users20960.exe
        
        C:\Users20960.exe
        6⤵
        
        PID:9552
      - C:\Users51935.exe
        
        C:\Users51935.exe
        6⤵
        
        PID:12932
      - C:\Users33817.exe
        
        C:\Users33817.exe
        6⤵
        
        PID:16032
    - - C:\Users\Admin26253.exe
        
        C:\Users\Admin26253.exe
        5⤵
        
        PID:4192
    - - C:\Users\Admin34850.exe
        
        C:\Users\Admin34850.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin17733.exe
        
        C:\Users\Admin17733.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData57138.exe
      C:\Users\Admin\AppData57138.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:548
    - - C:\Users\Admin40456.exe
        
        C:\Users\Admin40456.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1324
      - C:\Users9319.exe
        
        C:\Users9319.exe
        6⤵
        
        PID:1924
        
        C:\55910.exe
        
        C:\55910.exe
        7⤵
        
        PID:7036
        
        C:\16274.exe
        
        C:\16274.exe
        8⤵
        
        PID:10400
        
        C:\38400.exe
        
        C:\38400.exe
        8⤵
        
        PID:16124
        
        C:\62384.exe
        
        C:\62384.exe
        8⤵
        
        PID:6464
        
        C:\18416.exe
        
        C:\18416.exe
        7⤵
        
        PID:9128
        
        C:\3641.exe
        
        C:\3641.exe
        7⤵
        
        PID:12044
        
        C:\56019.exe
        
        C:\56019.exe
        7⤵
        
        PID:6304
      - C:\Users6470.exe
        
        C:\Users6470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\6351.exe
        
        C:\6351.exe
        7⤵
        
        PID:11972
        
        C:\26636.exe
        
        C:\26636.exe
        7⤵
        
        PID:15060
        
        C:\64736.exe
        
        C:\64736.exe
        7⤵
        
        PID:16944
      - C:\Users59370.exe
        
        C:\Users59370.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
      - C:\Users2682.exe
        
        C:\Users2682.exe
        6⤵
        
        PID:13568
      - C:\Users52014.exe
        
        C:\Users52014.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin4228.exe
        
        C:\Users\Admin4228.exe
        5⤵
        
        PID:2252
      - C:\Users17016.exe
        
        C:\Users17016.exe
        6⤵
        
        PID:6964
        
        C:\31432.exe
        
        C:\31432.exe
        7⤵
        
        PID:12228
        
        C:\954.exe
        
        C:\954.exe
        7⤵
        
        PID:13948
        
        C:\59282.exe
        
        C:\59282.exe
        7⤵
        
        PID:16920
      - C:\Users60819.exe
        
        C:\Users60819.exe
        6⤵
        
        PID:7660
      - C:\Users39028.exe
        
        C:\Users39028.exe
        6⤵
        
        PID:12984
      - C:\Users62241.exe
        
        C:\Users62241.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15980
    - - C:\Users\Admin46848.exe
        
        C:\Users\Admin46848.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6616
      - C:\Users40970.exe
        
        C:\Users40970.exe
        6⤵
        
        PID:11012
      - C:\Users32282.exe
        
        C:\Users32282.exe
        6⤵
        
        PID:14476
      - C:\Users1529.exe
        
        C:\Users1529.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
    - - C:\Users\Admin38017.exe
        
        C:\Users\Admin38017.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin841.exe
        
        C:\Users\Admin841.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin92.exe
        
        C:\Users\Admin92.exe
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData60611.exe
      C:\Users\Admin\AppData60611.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1880
    - - C:\Users\Admin5380.exe
        
        C:\Users\Admin5380.exe
        5⤵
        
        PID:5872
      - C:\Users16196.exe
        
        C:\Users16196.exe
        6⤵
        
        PID:8108
      - C:\Users11976.exe
        
        C:\Users11976.exe
        6⤵
        
        PID:10208
      - C:\Users42894.exe
        
        C:\Users42894.exe
        6⤵
        
        PID:14540
      - C:\Users20030.exe
        
        C:\Users20030.exe
        6⤵
        
        PID:16420
    - - C:\Users\Admin28347.exe
        
        C:\Users\Admin28347.exe
        5⤵
        
        PID:6724
    - - C:\Users\Admin35251.exe
        
        C:\Users\Admin35251.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin54292.exe
        
        C:\Users\Admin54292.exe
        5⤵
        
        PID:14736
    - - C:\Users\Admin44030.exe
        
        C:\Users\Admin44030.exe
        5⤵
        
        PID:17076
  - - C:\Users\Admin\AppData56580.exe
      C:\Users\Admin\AppData56580.exe
      4⤵
      PID:5328
    - - C:\Users\Admin59994.exe
        
        C:\Users\Admin59994.exe
        5⤵
        
        PID:7148
      - C:\Users45822.exe
        
        C:\Users45822.exe
        6⤵
        
        PID:11128
      - C:\Users8136.exe
        
        C:\Users8136.exe
        6⤵
        
        PID:16192
      - C:\Users11210.exe
        
        C:\Users11210.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin18416.exe
        
        C:\Users\Admin18416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9136
    - - C:\Users\Admin3641.exe
        
        C:\Users\Admin3641.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin30096.exe
        
        C:\Users\Admin30096.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData870.exe
      C:\Users\Admin\AppData870.exe
      4⤵
      PID:6672
    - - C:\Users\Admin61198.exe
        
        C:\Users\Admin61198.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin18468.exe
        
        C:\Users\Admin18468.exe
        5⤵
        
        PID:14116
    - - C:\Users\Admin32639.exe
        
        C:\Users\Admin32639.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData40764.exe
      C:\Users\Admin\AppData40764.exe
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData7443.exe
      C:\Users\Admin\AppData7443.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13388
  - - C:\Users\Admin\AppData50182.exe
      C:\Users\Admin\AppData50182.exe
      4⤵
      PID:15640
- - C:\Users\Admin\AppData\Local40330.exe
    C:\Users\Admin\AppData\Local40330.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData59786.exe
      C:\Users\Admin\AppData59786.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Users\Admin40710.exe
        
        C:\Users\Admin40710.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:468
      - C:\Users59506.exe
        
        C:\Users59506.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1868
        
        C:\15926.exe
        
        C:\15926.exe
        7⤵
        
        PID:2248
        
        C:\25184.exe
        
        C:\25184.exe
        8⤵
        
        PID:7024
        
        C:\32636.exe
        
        C:\32636.exe
        9⤵
        
        PID:10000
        
        C:\43574.exe
        
        C:\43574.exe
        9⤵
        
        PID:12804
        
        C:\39848.exe
        
        C:\39848.exe
        9⤵
        
        PID:2536
        
        C:\60819.exe
        
        C:\60819.exe
        8⤵
        
        PID:6880
        
        C:\22115.exe
        
        C:\22115.exe
        8⤵
        
        PID:12772
        
        C:\30337.exe
        
        C:\30337.exe
        8⤵
        
        PID:16880
        
        C:\6470.exe
        
        C:\6470.exe
        7⤵
        
        PID:6688
        
        C:\50176.exe
        
        C:\50176.exe
        8⤵
        
        PID:15876
        
        C:\41221.exe
        
        C:\41221.exe
        8⤵
        
        PID:17868
        
        C:\36812.exe
        
        C:\36812.exe
        7⤵
        
        PID:9584
        
        C:\43523.exe
        
        C:\43523.exe
        7⤵
        
        PID:13632
        
        C:\10981.exe
        
        C:\10981.exe
        7⤵
        
        PID:6704
      - C:\Users2666.exe
        
        C:\Users2666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5292
        
        C:\21868.exe
        
        C:\21868.exe
        7⤵
        
        PID:5928
        
        C:\64898.exe
        
        C:\64898.exe
        8⤵
        
        PID:10688
        
        C:\1748.exe
        
        C:\1748.exe
        8⤵
        
        PID:13976
        
        C:\34201.exe
        
        C:\34201.exe
        8⤵
        
        PID:6532
        
        C:\18913.exe
        
        C:\18913.exe
        7⤵
        
        PID:10168
        
        C:\63175.exe
        
        C:\63175.exe
        7⤵
        
        PID:12600
        
        C:\63690.exe
        
        C:\63690.exe
        7⤵
        
        PID:6208
      - C:\Users16889.exe
        
        C:\Users16889.exe
        6⤵
        
        PID:7072
        
        C:\17452.exe
        
        C:\17452.exe
        7⤵
        
        PID:2352
        
        C:\7394.exe
        
        C:\7394.exe
        7⤵
        
        PID:13740
        
        C:\19811.exe
        
        C:\19811.exe
        7⤵
        
        PID:16372
      - C:\Users54929.exe
        
        C:\Users54929.exe
        6⤵
        
        PID:9828
      - C:\Users54510.exe
        
        C:\Users54510.exe
        6⤵
        
        PID:12552
      - C:\Users30818.exe
        
        C:\Users30818.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin17082.exe
        
        C:\Users\Admin17082.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3896
      - C:\Users24094.exe
        
        C:\Users24094.exe
        6⤵
        
        PID:5128
        
        C:\39382.exe
        
        C:\39382.exe
        7⤵
        
        PID:7096
        
        C:\35132.exe
        
        C:\35132.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12024
        
        C:\47633.exe
        
        C:\47633.exe
        8⤵
        
        PID:13504
        
        C:\28363.exe
        
        C:\28363.exe
        8⤵
        
        PID:16476
        
        C:\18913.exe
        
        C:\18913.exe
        7⤵
        
        PID:10176
        
        C:\63175.exe
        
        C:\63175.exe
        7⤵
        
        PID:12556
        
        C:\22657.exe
        
        C:\22657.exe
        7⤵
        
        PID:4492
      - C:\Users57425.exe
        
        C:\Users57425.exe
        6⤵
        
        PID:6784
        
        C:\7607.exe
        
        C:\7607.exe
        7⤵
        
        PID:14984
        
        C:\27215.exe
        
        C:\27215.exe
        7⤵
        
        PID:18120
      - C:\Users36236.exe
        
        C:\Users36236.exe
        6⤵
        
        PID:7712
      - C:\Users26419.exe
        
        C:\Users26419.exe
        6⤵
        
        PID:13264
      - C:\Users53576.exe
        
        C:\Users53576.exe
        6⤵
        
        PID:15780
    - - C:\Users\Admin12317.exe
        
        C:\Users\Admin12317.exe
        5⤵
        
        PID:5256
      - C:\Users42288.exe
        
        C:\Users42288.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\36632.exe
        
        C:\36632.exe
        7⤵
        
        PID:16324
      - C:\Users18416.exe
        
        C:\Users18416.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9068
      - C:\Users3641.exe
        
        C:\Users3641.exe
        6⤵
        
        PID:12268
      - C:\Users15513.exe
        
        C:\Users15513.exe
        6⤵
        
        PID:18008
    - - C:\Users\Admin8364.exe
        
        C:\Users\Admin8364.exe
        5⤵
        
        PID:5500
      - C:\Users30472.exe
        
        C:\Users30472.exe
        6⤵
        
        PID:11400
      - C:\Users18468.exe
        
        C:\Users18468.exe
        6⤵
        
        PID:14524
      - C:\Users59282.exe
        
        C:\Users59282.exe
        6⤵
        
        PID:16580
    - - C:\Users\Admin38480.exe
        
        C:\Users\Admin38480.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin40112.exe
        
        C:\Users\Admin40112.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin54106.exe
        
        C:\Users\Admin54106.exe
        5⤵
        
        PID:16140
  - - C:\Users\Admin\AppData29012.exe
      C:\Users\Admin\AppData29012.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1836
    - - C:\Users\Admin3507.exe
        
        C:\Users\Admin3507.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users24094.exe
        
        C:\Users24094.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\53533.exe
        
        C:\53533.exe
        7⤵
        
        PID:6720
        
        C:\32151.exe
        
        C:\32151.exe
        7⤵
        
        PID:9180
        
        C:\9506.exe
        
        C:\9506.exe
        7⤵
        
        PID:13080
        
        C:\26933.exe
        
        C:\26933.exe
        7⤵
        
        PID:16064
      - C:\Users45365.exe
        
        C:\Users45365.exe
        6⤵
        
        PID:6740
        
        C:\38256.exe
        
        C:\38256.exe
        7⤵
        
        PID:10832
        
        C:\1748.exe
        
        C:\1748.exe
        7⤵
        
        PID:14192
        
        C:\21757.exe
        
        C:\21757.exe
        7⤵
        
        PID:16888
      - C:\Users10169.exe
        
        C:\Users10169.exe
        6⤵
        
        PID:9708
      - C:\Users61421.exe
        
        C:\Users61421.exe
        6⤵
        
        PID:13512
      - C:\Users18573.exe
        
        C:\Users18573.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin33392.exe
        
        C:\Users\Admin33392.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
      - C:\Users64078.exe
        
        C:\Users64078.exe
        6⤵
        
        PID:7004
        
        C:\16274.exe
        
        C:\16274.exe
        7⤵
        
        PID:3964
        
        C:\30039.exe
        
        C:\30039.exe
        7⤵
        
        PID:16152
        
        C:\17267.exe
        
        C:\17267.exe
        7⤵
        
        PID:16956
      - C:\Users18416.exe
        
        C:\Users18416.exe
        6⤵
        
        PID:9144
      - C:\Users3641.exe
        
        C:\Users3641.exe
        6⤵
        
        PID:12864
      - C:\Users27766.exe
        
        C:\Users27766.exe
        6⤵
        
        PID:18024
    - - C:\Users\Admin24289.exe
        
        C:\Users\Admin24289.exe
        5⤵
        
        PID:6716
      - C:\Users5967.exe
        
        C:\Users5967.exe
        6⤵
        
        PID:11488
      - C:\Users14384.exe
        
        C:\Users14384.exe
        6⤵
        
        PID:15096
      - C:\Users29925.exe
        
        C:\Users29925.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin7866.exe
        
        C:\Users\Admin7866.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin28443.exe
        
        C:\Users\Admin28443.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin2038.exe
        
        C:\Users\Admin2038.exe
        5⤵
        
        PID:5920
  - - C:\Users\Admin\AppData53376.exe
      C:\Users\Admin\AppData53376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:980
    - - C:\Users\Admin24094.exe
        
        C:\Users\Admin24094.exe
        5⤵
        
        PID:5136
      - C:\Users49112.exe
        
        C:\Users49112.exe
        6⤵
        
        PID:6912
        
        C:\38754.exe
        
        C:\38754.exe
        7⤵
        
        PID:7956
        
        C:\12168.exe
        
        C:\12168.exe
        7⤵
        
        PID:10900
        
        C:\15483.exe
        
        C:\15483.exe
        7⤵
        
        PID:14184
        
        C:\65147.exe
        
        C:\65147.exe
        7⤵
        
        PID:16392
      - C:\Users9926.exe
        
        C:\Users9926.exe
        6⤵
        
        PID:8232
      - C:\Users39308.exe
        
        C:\Users39308.exe
        6⤵
        
        PID:11560
      - C:\Users33985.exe
        
        C:\Users33985.exe
        6⤵
        
        PID:15088
      - C:\Users47930.exe
        
        C:\Users47930.exe
        6⤵
        
        PID:14664
    - - C:\Users\Admin30398.exe
        
        C:\Users\Admin30398.exe
        5⤵
        
        PID:6404
      - C:\Users58868.exe
        
        C:\Users58868.exe
        6⤵
        
        PID:10460
      - C:\Users56185.exe
        
        C:\Users56185.exe
        6⤵
        
        PID:13896
      - C:\Users59282.exe
        
        C:\Users59282.exe
        6⤵
        
        PID:16660
    - - C:\Users\Admin57232.exe
        
        C:\Users\Admin57232.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin30503.exe
        
        C:\Users\Admin30503.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin53576.exe
        
        C:\Users\Admin53576.exe
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData3792.exe
      C:\Users\Admin\AppData3792.exe
      4⤵
      PID:5344
    - - C:\Users\Admin54540.exe
        
        C:\Users\Admin54540.exe
        5⤵
        
        PID:2960
      - C:\Users23153.exe
        
        C:\Users23153.exe
        6⤵
        
        PID:17628
    - - C:\Users\Admin18416.exe
        
        C:\Users\Admin18416.exe
        5⤵
        
        PID:6660
    - - C:\Users\Admin19977.exe
        
        C:\Users\Admin19977.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin49989.exe
        
        C:\Users\Admin49989.exe
        5⤵
        
        PID:15824
  - - C:\Users\Admin\AppData46762.exe
      C:\Users\Admin\AppData46762.exe
      4⤵
      PID:1388
    - - C:\Users\Admin26004.exe
        
        C:\Users\Admin26004.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin1748.exe
        
        C:\Users\Admin1748.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin62982.exe
        
        C:\Users\Admin62982.exe
        5⤵
        
        PID:6012
  - - C:\Users\Admin\AppData564.exe
      C:\Users\Admin\AppData564.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData22367.exe
      C:\Users\Admin\AppData22367.exe
      4⤵
      PID:13180
  - - C:\Users\Admin\AppData30437.exe
      C:\Users\Admin\AppData30437.exe
      4⤵
      PID:16316
- - C:\Users\Admin\AppData\Local31097.exe
    C:\Users\Admin\AppData\Local31097.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData42656.exe
      C:\Users\Admin\AppData42656.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4808
    - - C:\Users\Admin26642.exe
        
        C:\Users\Admin26642.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3420
      - C:\Users59480.exe
        
        C:\Users59480.exe
        6⤵
        
        PID:5664
        
        C:\47716.exe
        
        C:\47716.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7528
        
        C:\321.exe
        
        C:\321.exe
        8⤵
        
        PID:11912
        
        C:\39962.exe
        
        C:\39962.exe
        8⤵
        
        PID:15764
        
        C:\62384.exe
        
        C:\62384.exe
        8⤵
        
        PID:6640
        
        C:\19568.exe
        
        C:\19568.exe
        7⤵
        
        PID:9112
        
        C:\20553.exe
        
        C:\20553.exe
        7⤵
        
        PID:13248
        
        C:\13040.exe
        
        C:\13040.exe
        7⤵
        
        PID:16096
      - C:\Users41446.exe
        
        C:\Users41446.exe
        6⤵
        
        PID:7900
      - C:\Users38540.exe
        
        C:\Users38540.exe
        6⤵
        
        PID:10384
      - C:\Users7534.exe
        
        C:\Users7534.exe
        6⤵
        
        PID:464
      - C:\Users53768.exe
        
        C:\Users53768.exe
        6⤵
        
        PID:6160
    - - C:\Users\Admin36106.exe
        
        C:\Users\Admin36106.exe
        5⤵
        
        PID:5816
      - C:\Users62708.exe
        
        C:\Users62708.exe
        6⤵
        
        PID:6576
        
        C:\23010.exe
        
        C:\23010.exe
        7⤵
        
        PID:12256
        
        C:\49247.exe
        
        C:\49247.exe
        7⤵
        
        PID:6328
      - C:\Users34752.exe
        
        C:\Users34752.exe
        6⤵
        
        PID:7112
      - C:\Users20553.exe
        
        C:\Users20553.exe
        6⤵
        
        PID:13164
      - C:\Users54073.exe
        
        C:\Users54073.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin22919.exe
        
        C:\Users\Admin22919.exe
        5⤵
        
        PID:6644
      - C:\Users36886.exe
        
        C:\Users36886.exe
        6⤵
        
        PID:10980
      - C:\Users55033.exe
        
        C:\Users55033.exe
        6⤵
        
        PID:13940
      - C:\Users11643.exe
        
        C:\Users11643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16160
    - - C:\Users\Admin56491.exe
        
        C:\Users\Admin56491.exe
        5⤵
        
        PID:9408
    - - C:\Users\Admin58786.exe
        
        C:\Users\Admin58786.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin6314.exe
        
        C:\Users\Admin6314.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData4638.exe
      C:\Users\Admin\AppData4638.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4628
    - - C:\Users\Admin6195.exe
        
        C:\Users\Admin6195.exe
        5⤵
        
        PID:5716
      - C:\Users62106.exe
        
        C:\Users62106.exe
        6⤵
        
        PID:7520
        
        C:\6351.exe
        
        C:\6351.exe
        7⤵
        
        PID:11988
        
        C:\39962.exe
        
        C:\39962.exe
        7⤵
        
        PID:15740
        
        C:\2877.exe
        
        C:\2877.exe
        7⤵
        
        PID:18072
      - C:\Users19568.exe
        
        C:\Users19568.exe
        6⤵
        
        PID:10084
      - C:\Users57310.exe
        
        C:\Users57310.exe
        6⤵
        
        PID:12876
      - C:\Users49797.exe
        
        C:\Users49797.exe
        6⤵
        
        PID:6236
    - - C:\Users\Admin41446.exe
        
        C:\Users\Admin41446.exe
        5⤵
        
        PID:7908
    - - C:\Users\Admin38540.exe
        
        C:\Users\Admin38540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10536
    - - C:\Users\Admin9096.exe
        
        C:\Users\Admin9096.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin53768.exe
        
        C:\Users\Admin53768.exe
        5⤵
        
        PID:940
  - - C:\Users\Admin\AppData49842.exe
      C:\Users\Admin\AppData49842.exe
      4⤵
      PID:5852
    - - C:\Users\Admin15453.exe
        
        C:\Users\Admin15453.exe
        5⤵
        
        PID:6584
      - C:\Users15698.exe
        
        C:\Users15698.exe
        6⤵
        
        PID:10936
      - C:\Users1748.exe
        
        C:\Users1748.exe
        6⤵
        
        PID:14168
      - C:\Users42370.exe
        
        C:\Users42370.exe
        6⤵
        
        PID:16836
    - - C:\Users\Admin18416.exe
        
        C:\Users\Admin18416.exe
        5⤵
        
        PID:8976
    - - C:\Users\Admin16277.exe
        
        C:\Users\Admin16277.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin62049.exe
        
        C:\Users\Admin62049.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData6610.exe
      C:\Users\Admin\AppData6610.exe
      4⤵
      PID:7396
    - - C:\Users\Admin14519.exe
        
        C:\Users\Admin14519.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin26636.exe
        
        C:\Users\Admin26636.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin56568.exe
        
        C:\Users\Admin56568.exe
        5⤵
        
        PID:16640
  - - C:\Users\Admin\AppData57146.exe
      C:\Users\Admin\AppData57146.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData37974.exe
      C:\Users\Admin\AppData37974.exe
      4⤵
      PID:12496
  - - C:\Users\Admin\AppData49830.exe
      C:\Users\Admin\AppData49830.exe
      4⤵
      PID:6288
- - C:\Users\Admin\AppData\Local54643.exe
    C:\Users\Admin\AppData\Local54643.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4932
  - - C:\Users\Admin\AppData61452.exe
      C:\Users\Admin\AppData61452.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2408
    - - C:\Users\Admin33030.exe
        
        C:\Users\Admin33030.exe
        5⤵
        
        PID:5576
      - C:\Users7477.exe
        
        C:\Users7477.exe
        6⤵
        
        PID:3268
        
        C:\30088.exe
        
        C:\30088.exe
        7⤵
        
        PID:9276
        
        C:\42588.exe
        
        C:\42588.exe
        7⤵
        
        PID:14280
        
        C:\51284.exe
        
        C:\51284.exe
        7⤵
        
        PID:18384
      - C:\Users18416.exe
        
        C:\Users18416.exe
        6⤵
        
        PID:9160
      - C:\Users19977.exe
        
        C:\Users19977.exe
        6⤵
        
        PID:13024
      - C:\Users27766.exe
        
        C:\Users27766.exe
        6⤵
        
        PID:18144
    - - C:\Users\Admin3651.exe
        
        C:\Users\Admin3651.exe
        5⤵
        
        PID:7732
    - - C:\Users\Admin61727.exe
        
        C:\Users\Admin61727.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin18329.exe
        
        C:\Users\Admin18329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
    - - C:\Users\Admin35286.exe
        
        C:\Users\Admin35286.exe
        5⤵
        
        PID:3060
  - - C:\Users\Admin\AppData46413.exe
      C:\Users\Admin\AppData46413.exe
      4⤵
      PID:5760
    - - C:\Users\Admin49854.exe
        
        C:\Users\Admin49854.exe
        5⤵
        
        PID:7492
      - C:\Users58074.exe
        
        C:\Users58074.exe
        6⤵
        
        PID:12272
      - C:\Users43356.exe
        
        C:\Users43356.exe
        6⤵
        
        PID:14668
      - C:\Users48976.exe
        
        C:\Users48976.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin15484.exe
        
        C:\Users\Admin15484.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin59448.exe
        
        C:\Users\Admin59448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13212
    - - C:\Users\Admin62241.exe
        
        C:\Users\Admin62241.exe
        5⤵
        
        PID:16172
  - - C:\Users\Admin\AppData10065.exe
      C:\Users\Admin\AppData10065.exe
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData31577.exe
      C:\Users\Admin\AppData31577.exe
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData38942.exe
      C:\Users\Admin\AppData38942.exe
      4⤵
      PID:13656
  - - C:\Users\Admin\AppData10782.exe
      C:\Users\Admin\AppData10782.exe
      4⤵
      PID:6420
- - C:\Users\Admin\AppData\Local15573.exe
    C:\Users\Admin\AppData\Local15573.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4944
  - - C:\Users\Admin\AppData31468.exe
      C:\Users\Admin\AppData31468.exe
      4⤵
      PID:5744
    - - C:\Users\Admin52594.exe
        
        C:\Users\Admin52594.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin18416.exe
        
        C:\Users\Admin18416.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9212
    - - C:\Users\Admin19977.exe
        
        C:\Users\Admin19977.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12856
    - - C:\Users\Admin23682.exe
        
        C:\Users\Admin23682.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18104
  - - C:\Users\Admin\AppData3154.exe
      C:\Users\Admin\AppData3154.exe
      4⤵
      PID:6960
    - - C:\Users\Admin40394.exe
        
        C:\Users\Admin40394.exe
        5⤵
        
        PID:10596
    - - C:\Users\Admin1748.exe
        
        C:\Users\Admin1748.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin55198.exe
        
        C:\Users\Admin55198.exe
        5⤵
        
        PID:16628
  - - C:\Users\Admin\AppData53724.exe
      C:\Users\Admin\AppData53724.exe
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData63175.exe
      C:\Users\Admin\AppData63175.exe
      4⤵
      PID:12456
  - - C:\Users\Admin\AppData59606.exe
      C:\Users\Admin\AppData59606.exe
      4⤵
      PID:6192
- - C:\Users\Admin\AppData\Local43142.exe
    C:\Users\Admin\AppData\Local43142.exe
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData38562.exe
      C:\Users\Admin\AppData38562.exe
      4⤵
      PID:6976
  - - C:\Users\Admin\AppData39386.exe
      C:\Users\Admin\AppData39386.exe
      4⤵
      PID:10748
  - - C:\Users\Admin\AppData62930.exe
      C:\Users\Admin\AppData62930.exe
      4⤵
      PID:14224
  - - C:\Users\Admin\AppData65147.exe
      C:\Users\Admin\AppData65147.exe
      4⤵
      PID:16468
- - C:\Users\Admin\AppData\Local32684.exe
    C:\Users\Admin\AppData\Local32684.exe
    3⤵
    PID:7420
- - C:\Users\Admin\AppData\Local49933.exe
    C:\Users\Admin\AppData\Local49933.exe
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local16882.exe
    C:\Users\Admin\AppData\Local16882.exe
    3⤵
    PID:14400
- - C:\Users\Admin\AppData\Local39800.exe
    C:\Users\Admin\AppData\Local39800.exe
    3⤵
    PID:4660
- C:\Users\Admin\AppData\Local\Temp33148.exe
  C:\Users\Admin\AppData\Local\Temp33148.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Users\Admin\AppData\Local2827.exe
    C:\Users\Admin\AppData\Local2827.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Users\Admin\AppData20892.exe
      C:\Users\Admin\AppData20892.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3592
    - - C:\Users\Admin16206.exe
        
        C:\Users\Admin16206.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4676
      - C:\Users9345.exe
        
        C:\Users9345.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\8935.exe
        
        C:\8935.exe
        7⤵
        
        PID:2812
        
        C:\40212.exe
        
        C:\40212.exe
        8⤵
        
        PID:6176
        
        C:\11613.exe
        
        C:\11613.exe
        9⤵
        
        PID:10716
        
        C:\1748.exe
        
        C:\1748.exe
        9⤵
        
        PID:14204
        
        C:\38286.exe
        
        C:\38286.exe
        9⤵
        
        PID:16896
        
        C:\50191.exe
        
        C:\50191.exe
        8⤵
        
        PID:8528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8528 -s 632
        9⤵
        Program crash
        
        PID:7540
        
        C:\47668.exe
        
        C:\47668.exe
        8⤵
        
        PID:12168
        
        C:\62957.exe
        
        C:\62957.exe
        8⤵
        
        PID:14720
        
        C:\25755.exe
        
        C:\25755.exe
        8⤵
        
        PID:17040
        
        C:\10040.exe
        
        C:\10040.exe
        7⤵
        
        PID:6220
        
        C:\42838.exe
        
        C:\42838.exe
        8⤵
        
        PID:7992
        
        C:\25188.exe
        
        C:\25188.exe
        8⤵
        
        PID:11028
        
        C:\15483.exe
        
        C:\15483.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14084
        
        C:\44151.exe
        
        C:\44151.exe
        8⤵
        
        PID:16608
        
        C:\7325.exe
        
        C:\7325.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
        
        C:\54353.exe
        
        C:\54353.exe
        7⤵
        
        PID:9184
        
        C:\841.exe
        
        C:\841.exe
        7⤵
        
        PID:13068
        
        C:\32956.exe
        
        C:\32956.exe
        7⤵
        
        PID:16228
      - C:\Users62775.exe
        
        C:\Users62775.exe
        6⤵
        
        PID:4412
        
        C:\3071.exe
        
        C:\3071.exe
        7⤵
        
        PID:5420
        
        C:\1566.exe
        
        C:\1566.exe
        8⤵
        
        PID:8340
        
        C:\6443.exe
        
        C:\6443.exe
        8⤵
        
        PID:11708
        
        C:\46237.exe
        
        C:\46237.exe
        8⤵
        
        PID:15056
        
        C:\25563.exe
        
        C:\25563.exe
        8⤵
        
        PID:5188
        
        C:\48053.exe
        
        C:\48053.exe
        7⤵
        
        PID:6520
        
        C:\33469.exe
        
        C:\33469.exe
        7⤵
        
        PID:12208
        
        C:\62957.exe
        
        C:\62957.exe
        7⤵
        
        PID:14752
        
        C:\29839.exe
        
        C:\29839.exe
        7⤵
        
        PID:17056
      - C:\Users833.exe
        
        C:\Users833.exe
        6⤵
        
        PID:3972
        
        C:\39076.exe
        
        C:\39076.exe
        7⤵
        
        PID:7324
        
        C:\39900.exe
        
        C:\39900.exe
        7⤵
        
        PID:12476
        
        C:\32639.exe
        
        C:\32639.exe
        7⤵
        
        PID:6512
      - C:\Users4254.exe
        
        C:\Users4254.exe
        6⤵
        
        PID:7776
      - C:\Users36507.exe
        
        C:\Users36507.exe
        6⤵
        
        PID:11604
      - C:\Users37692.exe
        
        C:\Users37692.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15788
      - C:\Users44970.exe
        
        C:\Users44970.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin5816.exe
        
        C:\Users\Admin5816.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4184
      - C:\Users29356.exe
        
        C:\Users29356.exe
        6⤵
        
        PID:228
        
        C:\3071.exe
        
        C:\3071.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5424
        
        C:\30472.exe
        
        C:\30472.exe
        8⤵
        
        PID:11372
        
        C:\48130.exe
        
        C:\48130.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15812
        
        C:\62384.exe
        
        C:\62384.exe
        8⤵
        
        PID:5548
        
        C:\23740.exe
        
        C:\23740.exe
        7⤵
        
        PID:7620
        
        C:\18311.exe
        
        C:\18311.exe
        7⤵
        
        PID:10360
        
        C:\21540.exe
        
        C:\21540.exe
        7⤵
        
        PID:13664
        
        C:\11365.exe
        
        C:\11365.exe
        7⤵
        
        PID:16456
      - C:\Users52635.exe
        
        C:\Users52635.exe
        6⤵
        
        PID:5728
        
        C:\14161.exe
        
        C:\14161.exe
        7⤵
        
        PID:9208
        
        C:\10902.exe
        
        C:\10902.exe
        7⤵
        
        PID:13256
        
        C:\25649.exe
        
        C:\25649.exe
        7⤵
        
        PID:16084
      - C:\Users48166.exe
        
        C:\Users48166.exe
        6⤵
        
        PID:8284
      - C:\Users18530.exe
        
        C:\Users18530.exe
        6⤵
        
        PID:11636
      - C:\Users25319.exe
        
        C:\Users25319.exe
        6⤵
        
        PID:15072
      - C:\Users43646.exe
        
        C:\Users43646.exe
        6⤵
        
        PID:6352
    - - C:\Users\Admin667.exe
        
        C:\Users\Admin667.exe
        5⤵
        
        PID:5064
      - C:\Users58302.exe
        
        C:\Users58302.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
        
        C:\61120.exe
        
        C:\61120.exe
        7⤵
        
        PID:6668
        
        C:\15650.exe
        
        C:\15650.exe
        7⤵
        
        PID:12176
        
        C:\57092.exe
        
        C:\57092.exe
        7⤵
        
        PID:14652
        
        C:\54841.exe
        
        C:\54841.exe
        7⤵
        
        PID:16564
      - C:\Users23356.exe
        
        C:\Users23356.exe
        6⤵
        
        PID:7176
      - C:\Users25903.exe
        
        C:\Users25903.exe
        6⤵
        
        PID:10868
      - C:\Users21348.exe
        
        C:\Users21348.exe
        6⤵
        
        PID:14032
      - C:\Users30825.exe
        
        C:\Users30825.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1504
    - - C:\Users\Admin6698.exe
        
        C:\Users\Admin6698.exe
        5⤵
        
        PID:5784
      - C:\Users16196.exe
        
        C:\Users16196.exe
        6⤵
        
        PID:8084
      - C:\Users29272.exe
        
        C:\Users29272.exe
        6⤵
        
        PID:11204
      - C:\Users46018.exe
        
        C:\Users46018.exe
        6⤵
        
        PID:13876
      - C:\Users30337.exe
        
        C:\Users30337.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin2003.exe
        
        C:\Users\Admin2003.exe
        5⤵
        
        PID:7508
    - - C:\Users\Admin64513.exe
        
        C:\Users\Admin64513.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin60660.exe
        
        C:\Users\Admin60660.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin6317.exe
        
        C:\Users\Admin6317.exe
        5⤵
        
        PID:2696
  - - C:\Users\Admin\AppData43402.exe
      C:\Users\Admin\AppData43402.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:224
    - - C:\Users\Admin13813.exe
        
        C:\Users\Admin13813.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2144
      - C:\Users52874.exe
        
        C:\Users52874.exe
        6⤵
        
        PID:1808
        
        C:\25184.exe
        
        C:\25184.exe
        7⤵
        
        PID:7016
        
        C:\42340.exe
        
        C:\42340.exe
        8⤵
        
        PID:10724
        
        C:\1748.exe
        
        C:\1748.exe
        8⤵
        
        PID:14148
        
        C:\56568.exe
        
        C:\56568.exe
        8⤵
        
        PID:16932
        
        C:\18416.exe
        
        C:\18416.exe
        7⤵
        
        PID:9104
        
        C:\19977.exe
        
        C:\19977.exe
        7⤵
        
        PID:12816
        
        C:\27431.exe
        
        C:\27431.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4160
      - C:\Users4332.exe
        
        C:\Users4332.exe
        6⤵
        
        PID:6744
        
        C:\14929.exe
        
        C:\14929.exe
        7⤵
        
        PID:10228
        
        C:\4872.exe
        
        C:\4872.exe
        7⤵
        
        PID:13548
        
        C:\3475.exe
        
        C:\3475.exe
        7⤵
        
        PID:6936
      - C:\Users31959.exe
        
        C:\Users31959.exe
        6⤵
        
        PID:8536
      - C:\Users30503.exe
        
        C:\Users30503.exe
        6⤵
        
        PID:13224
      - C:\Users53576.exe
        
        C:\Users53576.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin19002.exe
        
        C:\Users\Admin19002.exe
        5⤵
        
        PID:5360
      - C:\Users18386.exe
        
        C:\Users18386.exe
        6⤵
        
        PID:6924
        
        C:\64898.exe
        
        C:\64898.exe
        7⤵
        
        PID:10840
        
        C:\1748.exe
        
        C:\1748.exe
        7⤵
        
        PID:14176
        
        C:\54814.exe
        
        C:\54814.exe
        7⤵
        
        PID:6004
      - C:\Users60819.exe
        
        C:\Users60819.exe
        6⤵
        
        PID:8044
      - C:\Users22115.exe
        
        C:\Users22115.exe
        6⤵
        
        PID:12796
      - C:\Users58492.exe
        
        C:\Users58492.exe
        6⤵
        
        PID:18052
    - - C:\Users\Admin52302.exe
        
        C:\Users\Admin52302.exe
        5⤵
        
        PID:6524
      - C:\Users38256.exe
        
        C:\Users38256.exe
        6⤵
        
        PID:10816
      - C:\Users14000.exe
        
        C:\Users14000.exe
        6⤵
        
        PID:13352
      - C:\Users64736.exe
        
        C:\Users64736.exe
        6⤵
        
        PID:16780
    - - C:\Users\Admin35879.exe
        
        C:\Users\Admin35879.exe
        5⤵
        
        PID:7728
    - - C:\Users\Admin17753.exe
        
        C:\Users\Admin17753.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin6314.exe
        
        C:\Users\Admin6314.exe
        5⤵
        
        PID:2108
  - - C:\Users\Admin\AppData50662.exe
      C:\Users\Admin\AppData50662.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1632
    - - C:\Users\Admin54820.exe
        
        C:\Users\Admin54820.exe
        5⤵
        
        PID:1720
      - C:\Users14301.exe
        
        C:\Users14301.exe
        6⤵
        
        PID:6900
        
        C:\65282.exe
        
        C:\65282.exe
        7⤵
        
        PID:11356
        
        C:\49195.exe
        
        C:\49195.exe
        7⤵
        
        PID:14100
        
        C:\20387.exe
        
        C:\20387.exe
        7⤵
        
        PID:16828
      - C:\Users60819.exe
        
        C:\Users60819.exe
        6⤵
        
        PID:7860
      - C:\Users12385.exe
        
        C:\Users12385.exe
        6⤵
        
        PID:12224
      - C:\Users56019.exe
        
        C:\Users56019.exe
        6⤵
        
        PID:16276
    - - C:\Users\Admin30398.exe
        
        C:\Users\Admin30398.exe
        5⤵
        
        PID:6392
      - C:\Users6351.exe
        
        C:\Users6351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12048
      - C:\Users47633.exe
        
        C:\Users47633.exe
        6⤵
        
        PID:13556
      - C:\Users50730.exe
        
        C:\Users50730.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin36812.exe
        
        C:\Users\Admin36812.exe
        5⤵
        
        PID:9720
    - - C:\Users\Admin28941.exe
        
        C:\Users\Admin28941.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin58044.exe
        
        C:\Users\Admin58044.exe
        5⤵
        
        PID:6856
    - - C:\Users\Admin44941.exe
        
        C:\Users\Admin44941.exe
        5⤵
        
        PID:17784
  - - C:\Users\Admin\AppData23637.exe
      C:\Users\Admin\AppData23637.exe
      4⤵
      PID:5196
    - - C:\Users\Admin38204.exe
        
        C:\Users\Admin38204.exe
        5⤵
        
        PID:6248
      - C:\Users50700.exe
        
        C:\Users50700.exe
        6⤵
        
        PID:10448
      - C:\Users55033.exe
        
        C:\Users55033.exe
        6⤵
        
        PID:14012
      - C:\Users50730.exe
        
        C:\Users50730.exe
        6⤵
        
        PID:2800
    - - C:\Users\Admin18416.exe
        
        C:\Users\Admin18416.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin3641.exe
        
        C:\Users\Admin3641.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin29377.exe
        
        C:\Users\Admin29377.exe
        5⤵
        
        PID:4460
  - - C:\Users\Admin\AppData61152.exe
      C:\Users\Admin\AppData61152.exe
      4⤵
      PID:7120
    - - C:\Users\Admin53736.exe
        
        C:\Users\Admin53736.exe
        5⤵
        
        PID:11120
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7120 -s 660
        5⤵
        Program crash
        
        PID:15652
  - - C:\Users\Admin\AppData25644.exe
      C:\Users\Admin\AppData25644.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData57178.exe
      C:\Users\Admin\AppData57178.exe
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData61163.exe
      C:\Users\Admin\AppData61163.exe
      4⤵
      PID:3960
- - C:\Users\Admin\AppData\Local39920.exe
    C:\Users\Admin\AppData\Local39920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5012
  - - C:\Users\Admin\AppData30404.exe
      C:\Users\Admin\AppData30404.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2504
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2504 -s 488
        5⤵
        Program crash
        
        PID:1644
  - - C:\Users\Admin\AppData25634.exe
      C:\Users\Admin\AppData25634.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1240
    - - C:\Users\Admin60440.exe
        
        C:\Users\Admin60440.exe
        5⤵
        
        PID:4100
      - C:\Users38754.exe
        
        C:\Users38754.exe
        6⤵
        
        PID:7964
      - C:\Users12168.exe
        
        C:\Users12168.exe
        6⤵
        
        PID:10892
      - C:\Users15483.exe
        
        C:\Users15483.exe
        6⤵
        
        PID:14124
      - C:\Users62433.exe
        
        C:\Users62433.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin39168.exe
        
        C:\Users\Admin39168.exe
        5⤵
        
        PID:3580
    - - C:\Users\Admin51333.exe
        
        C:\Users\Admin51333.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin56482.exe
        
        C:\Users\Admin56482.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData4917.exe
      C:\Users\Admin\AppData4917.exe
      4⤵
      PID:5812
    - - C:\Users\Admin55168.exe
        
        C:\Users\Admin55168.exe
        5⤵
        
        PID:10588
    - - C:\Users\Admin49195.exe
        
        C:\Users\Admin49195.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin42370.exe
        
        C:\Users\Admin42370.exe
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData13190.exe
      C:\Users\Admin\AppData13190.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData36507.exe
      C:\Users\Admin\AppData36507.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData43594.exe
      C:\Users\Admin\AppData43594.exe
      4⤵
      PID:15300
  - - C:\Users\Admin\AppData61096.exe
      C:\Users\Admin\AppData61096.exe
      4⤵
      PID:17176
- - C:\Users\Admin\AppData\Local36526.exe
    C:\Users\Admin\AppData\Local36526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData24504.exe
      C:\Users\Admin\AppData24504.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5024
    - - C:\Users\Admin32838.exe
        
        C:\Users\Admin32838.exe
        5⤵
        
        PID:5684
      - C:\Users44976.exe
        
        C:\Users44976.exe
        6⤵
        
        PID:7868
      - C:\Users44649.exe
        
        C:\Users44649.exe
        6⤵
        
        PID:9944
      - C:\Users13921.exe
        
        C:\Users13921.exe
        6⤵
        
        PID:14700
      - C:\Users21400.exe
        
        C:\Users21400.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin6636.exe
        
        C:\Users\Admin6636.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin38540.exe
        
        C:\Users\Admin38540.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin49143.exe
        
        C:\Users\Admin49143.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin57803.exe
        
        C:\Users\Admin57803.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData36106.exe
      C:\Users\Admin\AppData36106.exe
      4⤵
      PID:5844
    - - C:\Users\Admin50264.exe
        
        C:\Users\Admin50264.exe
        5⤵
        
        PID:6448
      - C:\Users38256.exe
        
        C:\Users38256.exe
        6⤵
        
        PID:2336
      - C:\Users45608.exe
        
        C:\Users45608.exe
        6⤵
        
        PID:15616
      - C:\Users5015.exe
        
        C:\Users5015.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin39988.exe
        
        C:\Users\Admin39988.exe
        5⤵
        
        PID:6088
    - - C:\Users\Admin59448.exe
        
        C:\Users\Admin59448.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin62241.exe
        
        C:\Users\Admin62241.exe
        5⤵
        
        PID:16016
  - - C:\Users\Admin\AppData12997.exe
      C:\Users\Admin\AppData12997.exe
      4⤵
      PID:7444
    - - C:\Users\Admin37270.exe
        
        C:\Users\Admin37270.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin954.exe
        
        C:\Users\Admin954.exe
        5⤵
        
        PID:14456
    - - C:\Users\Admin32639.exe
        
        C:\Users\Admin32639.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData39169.exe
      C:\Users\Admin\AppData39169.exe
      4⤵
      PID:10072
  - - C:\Users\Admin\AppData54702.exe
      C:\Users\Admin\AppData54702.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData57461.exe
      C:\Users\Admin\AppData57461.exe
      4⤵
      PID:6368
- - C:\Users\Admin\AppData\Local36491.exe
    C:\Users\Admin\AppData\Local36491.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2772
  - - C:\Users\Admin\AppData4825.exe
      C:\Users\Admin\AppData4825.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5772
    - - C:\Users\Admin60352.exe
        
        C:\Users\Admin60352.exe
        5⤵
        
        PID:7700
    - - C:\Users\Admin42126.exe
        
        C:\Users\Admin42126.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7932
    - - C:\Users\Admin6931.exe
        
        C:\Users\Admin6931.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin17508.exe
        
        C:\Users\Admin17508.exe
        5⤵
        
        PID:5632
  - - C:\Users\Admin\AppData16942.exe
      C:\Users\Admin\AppData16942.exe
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData5291.exe
      C:\Users\Admin\AppData5291.exe
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData62765.exe
      C:\Users\Admin\AppData62765.exe
      4⤵
      PID:13972
  - - C:\Users\Admin\AppData25563.exe
      C:\Users\Admin\AppData25563.exe
      4⤵
      PID:6240
- - C:\Users\Admin\AppData\Local20783.exe
    C:\Users\Admin\AppData\Local20783.exe
    3⤵
    PID:684
  - - C:\Users\Admin\AppData39076.exe
      C:\Users\Admin\AppData39076.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData48069.exe
      C:\Users\Admin\AppData48069.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData14165.exe
      C:\Users\Admin\AppData14165.exe
      4⤵
      PID:17116
- - C:\Users\Admin\AppData\Local42452.exe
    C:\Users\Admin\AppData\Local42452.exe
    3⤵
    PID:5308
- - C:\Users\Admin\AppData\Local36270.exe
    C:\Users\Admin\AppData\Local36270.exe
    3⤵
    PID:10344
- - C:\Users\Admin\AppData\Local52559.exe
    C:\Users\Admin\AppData\Local52559.exe
    3⤵
    PID:13792
- - C:\Users\Admin\AppData\Local60488.exe
    C:\Users\Admin\AppData\Local60488.exe
    3⤵
    PID:5912
- C:\Users\Admin\AppData\Local\Temp31507.exe
  C:\Users\Admin\AppData\Local\Temp31507.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Users\Admin\AppData\Local59786.exe
    C:\Users\Admin\AppData\Local59786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2496
  - - C:\Users\Admin\AppData50824.exe
      C:\Users\Admin\AppData50824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:800
    - - C:\Users\Admin34810.exe
        
        C:\Users\Admin34810.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1796
      - C:\Users55588.exe
        
        C:\Users55588.exe
        6⤵
        
        PID:5552
        
        C:\59994.exe
        
        C:\59994.exe
        7⤵
        
        PID:7052
        
        C:\58437.exe
        
        C:\58437.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12260
        
        C:\41332.exe
        
        C:\41332.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15328
        
        C:\34037.exe
        
        C:\34037.exe
        8⤵
        
        PID:6316
        
        C:\60819.exe
        
        C:\60819.exe
        7⤵
        
        PID:8196
        
        C:\32421.exe
        
        C:\32421.exe
        7⤵
        
        PID:13008
        
        C:\15129.exe
        
        C:\15129.exe
        7⤵
        
        PID:16724
      - C:\Users4332.exe
        
        C:\Users4332.exe
        6⤵
        
        PID:6756
      - C:\Users32151.exe
        
        C:\Users32151.exe
        6⤵
        
        PID:7328
      - C:\Users25843.exe
        
        C:\Users25843.exe
        6⤵
        
        PID:12888
      - C:\Users53576.exe
        
        C:\Users53576.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16216
    - - C:\Users\Admin9848.exe
        
        C:\Users\Admin9848.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
      - C:\Users28448.exe
        
        C:\Users28448.exe
        6⤵
        
        PID:8156
      - C:\Users59999.exe
        
        C:\Users59999.exe
        6⤵
        
        PID:11104
      - C:\Users51473.exe
        
        C:\Users51473.exe
        6⤵
        
        PID:15644
      - C:\Users17395.exe
        
        C:\Users17395.exe
        6⤵
        
        PID:16960
    - - C:\Users\Admin2281.exe
        
        C:\Users\Admin2281.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin31769.exe
        
        C:\Users\Admin31769.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin12683.exe
        
        C:\Users\Admin12683.exe
        5⤵
        
        PID:14676
    - - C:\Users\Admin26926.exe
        
        C:\Users\Admin26926.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData27693.exe
      C:\Users\Admin\AppData27693.exe
      4⤵
      PID:2300
    - - C:\Users\Admin51442.exe
        
        C:\Users\Admin51442.exe
        5⤵
        
        PID:6768
      - C:\Users12111.exe
        
        C:\Users12111.exe
        6⤵
        
        PID:8004
      - C:\Users46787.exe
        
        C:\Users46787.exe
        6⤵
        
        PID:1576
      - C:\Users38618.exe
        
        C:\Users38618.exe
        6⤵
        
        PID:12764
      - C:\Users20030.exe
        
        C:\Users20030.exe
        6⤵
        
        PID:16428
    - - C:\Users\Admin18094.exe
        
        C:\Users\Admin18094.exe
        5⤵
        
        PID:8260
    - - C:\Users\Admin12665.exe
        
        C:\Users\Admin12665.exe
        5⤵
        
        PID:11628
    - - C:\Users\Admin33985.exe
        
        C:\Users\Admin33985.exe
        5⤵
        
        PID:15348
    - - C:\Users\Admin60566.exe
        
        C:\Users\Admin60566.exe
        5⤵
        
        PID:17168
  - - C:\Users\Admin\AppData17518.exe
      C:\Users\Admin\AppData17518.exe
      4⤵
      PID:5736
    - - C:\Users\Admin57114.exe
        
        C:\Users\Admin57114.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin64466.exe
        
        C:\Users\Admin64466.exe
        5⤵
        
        PID:15896
    - - C:\Users\Admin32091.exe
        
        C:\Users\Admin32091.exe
        5⤵
        
        PID:624
  - - C:\Users\Admin\AppData29351.exe
      C:\Users\Admin\AppData29351.exe
      4⤵
      PID:7760
  - - C:\Users\Admin\AppData49842.exe
      C:\Users\Admin\AppData49842.exe
      4⤵
      PID:13088
  - - C:\Users\Admin\AppData23379.exe
      C:\Users\Admin\AppData23379.exe
      4⤵
      PID:16164
- - C:\Users\Admin\AppData\Local39126.exe
    C:\Users\Admin\AppData\Local39126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5092
  - - C:\Users\Admin\AppData16336.exe
      C:\Users\Admin\AppData16336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:716
    - - C:\Users\Admin25246.exe
        
        C:\Users\Admin25246.exe
        5⤵
        
        PID:5880
      - C:\Users42288.exe
        
        C:\Users42288.exe
        6⤵
        
        PID:6216
        
        C:\40394.exe
        
        C:\40394.exe
        7⤵
        
        PID:10548
        
        C:\1748.exe
        
        C:\1748.exe
        7⤵
        
        PID:14156
        
        C:\25841.exe
        
        C:\25841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16812
      - C:\Users18416.exe
        
        C:\Users18416.exe
        6⤵
        
        PID:6308
      - C:\Users3641.exe
        
        C:\Users3641.exe
        6⤵
        
        PID:11588
      - C:\Users25244.exe
        
        C:\Users25244.exe
        6⤵
        
        PID:17856
    - - C:\Users\Admin54301.exe
        
        C:\Users\Admin54301.exe
        5⤵
        
        PID:5428
      - C:\Users54592.exe
        
        C:\Users54592.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10468
      - C:\Users23433.exe
        
        C:\Users23433.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15948
      - C:\Users17075.exe
        
        C:\Users17075.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin41280.exe
        
        C:\Users\Admin41280.exe
        5⤵
        
        PID:7880
    - - C:\Users\Admin65313.exe
        
        C:\Users\Admin65313.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin45408.exe
        
        C:\Users\Admin45408.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData11794.exe
      C:\Users\Admin\AppData11794.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5592
    - - C:\Users\Admin50700.exe
        
        C:\Users\Admin50700.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin55033.exe
        
        C:\Users\Admin55033.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin20387.exe
        
        C:\Users\Admin20387.exe
        5⤵
        
        PID:16616
  - - C:\Users\Admin\AppData2281.exe
      C:\Users\Admin\AppData2281.exe
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData31769.exe
      C:\Users\Admin\AppData31769.exe
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData43218.exe
      C:\Users\Admin\AppData43218.exe
      4⤵
      PID:14384
  - - C:\Users\Admin\AppData50549.exe
      C:\Users\Admin\AppData50549.exe
      4⤵
      PID:17840
- - C:\Users\Admin\AppData\Local30625.exe
    C:\Users\Admin\AppData\Local30625.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3368
  - - C:\Users\Admin\AppData18832.exe
      C:\Users\Admin\AppData18832.exe
      4⤵
      PID:5504
    - - C:\Users\Admin39574.exe
        
        C:\Users\Admin39574.exe
        5⤵
        
        PID:6944
      - C:\Users22112.exe
        
        C:\Users22112.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10560
      - C:\Users1748.exe
        
        C:\Users1748.exe
        6⤵
        
        PID:14136
      - C:\Users21757.exe
        
        C:\Users21757.exe
        6⤵
        
        PID:16736
    - - C:\Users\Admin60819.exe
        
        C:\Users\Admin60819.exe
        5⤵
        
        PID:8212
    - - C:\Users\Admin44482.exe
        
        C:\Users\Admin44482.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin35599.exe
        
        C:\Users\Admin35599.exe
        5⤵
        
        PID:16056
  - - C:\Users\Admin\AppData30398.exe
      C:\Users\Admin\AppData30398.exe
      4⤵
      PID:6388
    - - C:\Users\Admin10243.exe
        
        C:\Users\Admin10243.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin32282.exe
        
        C:\Users\Admin32282.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin34009.exe
        
        C:\Users\Admin34009.exe
        5⤵
        
        PID:3936
  - - C:\Users\Admin\AppData43034.exe
      C:\Users\Admin\AppData43034.exe
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData41385.exe
      C:\Users\Admin\AppData41385.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13728
  - - C:\Users\Admin\AppData52398.exe
      C:\Users\Admin\AppData52398.exe
      4⤵
      PID:3492
- - C:\Users\Admin\AppData\Local92.exe
    C:\Users\Admin\AppData\Local92.exe
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData25952.exe
      C:\Users\Admin\AppData25952.exe
      4⤵
      PID:6080
    - - C:\Users\Admin45438.exe
        
        C:\Users\Admin45438.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin53855.exe
        
        C:\Users\Admin53855.exe
        5⤵
        
        PID:1752
    - - C:\Users\Admin63366.exe
        
        C:\Users\Admin63366.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData18416.exe
      C:\Users\Admin\AppData18416.exe
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData19977.exe
      C:\Users\Admin\AppData19977.exe
      4⤵
      PID:12940
  - - C:\Users\Admin\AppData27766.exe
      C:\Users\Admin\AppData27766.exe
      4⤵
      PID:17992
- - C:\Users\Admin\AppData\Local48900.exe
    C:\Users\Admin\AppData\Local48900.exe
    3⤵
    PID:6980
  - - C:\Users\Admin\AppData30472.exe
      C:\Users\Admin\AppData30472.exe
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData18468.exe
      C:\Users\Admin\AppData18468.exe
      4⤵
      PID:15356
  - - C:\Users\Admin\AppData56568.exe
      C:\Users\Admin\AppData56568.exe
      4⤵
      PID:16596
- - C:\Users\Admin\AppData\Local17476.exe
    C:\Users\Admin\AppData\Local17476.exe
    3⤵
    PID:9672
- - C:\Users\Admin\AppData\Local55040.exe
    C:\Users\Admin\AppData\Local55040.exe
    3⤵
    PID:12520
- - C:\Users\Admin\AppData\Local11963.exe
    C:\Users\Admin\AppData\Local11963.exe
    3⤵
    PID:6124
- C:\Users\Admin\AppData\Local\Temp36963.exe
  C:\Users\Admin\AppData\Local\Temp36963.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4640
- - C:\Users\Admin\AppData\Local54908.exe
    C:\Users\Admin\AppData\Local54908.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1964
  - - C:\Users\Admin\AppData16336.exe
      C:\Users\Admin\AppData16336.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4708
    - - C:\Users\Admin60440.exe
        
        C:\Users\Admin60440.exe
        5⤵
        
        PID:5152
      - C:\Users5993.exe
        
        C:\Users5993.exe
        6⤵
        
        PID:9848
      - C:\Users10902.exe
        
        C:\Users10902.exe
        6⤵
        
        PID:13232
      - C:\Users7175.exe
        
        C:\Users7175.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16044
    - - C:\Users\Admin48053.exe
        
        C:\Users\Admin48053.exe
        5⤵
        
        PID:6168
    - - C:\Users\Admin38540.exe
        
        C:\Users\Admin38540.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin9096.exe
        
        C:\Users\Admin9096.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin47930.exe
        
        C:\Users\Admin47930.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5976
  - - C:\Users\Admin\AppData12370.exe
      C:\Users\Admin\AppData12370.exe
      4⤵
      PID:6032
    - - C:\Users\Admin51006.exe
        
        C:\Users\Admin51006.exe
        5⤵
        
        PID:8092
    - - C:\Users\Admin59999.exe
        
        C:\Users\Admin59999.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin46018.exe
        
        C:\Users\Admin46018.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14360
    - - C:\Users\Admin5064.exe
        
        C:\Users\Admin5064.exe
        5⤵
        
        PID:2756
  - - C:\Users\Admin\AppData39614.exe
      C:\Users\Admin\AppData39614.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData24177.exe
      C:\Users\Admin\AppData24177.exe
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData29403.exe
      C:\Users\Admin\AppData29403.exe
      4⤵
      PID:13964
  - - C:\Users\Admin\AppData31394.exe
      C:\Users\Admin\AppData31394.exe
      4⤵
      PID:5904
- - C:\Users\Admin\AppData\Local16890.exe
    C:\Users\Admin\AppData\Local16890.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData2111.exe
      C:\Users\Admin\AppData2111.exe
      4⤵
      PID:5700
    - - C:\Users\Admin55884.exe
        
        C:\Users\Admin55884.exe
        5⤵
        
        PID:7552
      - C:\Users50508.exe
        
        C:\Users50508.exe
        6⤵
        
        PID:10248
      - C:\Users45608.exe
        
        C:\Users45608.exe
        6⤵
        
        PID:15608
      - C:\Users34229.exe
        
        C:\Users34229.exe
        6⤵
        
        PID:1416
    - - C:\Users\Admin15484.exe
        
        C:\Users\Admin15484.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin59448.exe
        
        C:\Users\Admin59448.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin25293.exe
        
        C:\Users\Admin25293.exe
        5⤵
        
        PID:2188
  - - C:\Users\Admin\AppData14804.exe
      C:\Users\Admin\AppData14804.exe
      4⤵
      PID:7924
  - - C:\Users\Admin\AppData63044.exe
      C:\Users\Admin\AppData63044.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData9096.exe
      C:\Users\Admin\AppData9096.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData17011.exe
      C:\Users\Admin\AppData17011.exe
      4⤵
      PID:16200
- - C:\Users\Admin\AppData\Local49842.exe
    C:\Users\Admin\AppData\Local49842.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData13481.exe
      C:\Users\Admin\AppData13481.exe
      4⤵
      PID:7612
    - - C:\Users\Admin44722.exe
        
        C:\Users\Admin44722.exe
        5⤵
        
        PID:16308
    - - C:\Users\Admin4081.exe
        
        C:\Users\Admin4081.exe
        5⤵
        
        PID:18092
  - - C:\Users\Admin\AppData4986.exe
      C:\Users\Admin\AppData4986.exe
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData59448.exe
      C:\Users\Admin\AppData59448.exe
      4⤵
      PID:13124
  - - C:\Users\Admin\AppData60103.exe
      C:\Users\Admin\AppData60103.exe
      4⤵
      PID:1672
- - C:\Users\Admin\AppData\Local11846.exe
    C:\Users\Admin\AppData\Local11846.exe
    3⤵
    PID:8020
- - C:\Users\Admin\AppData\Local40208.exe
    C:\Users\Admin\AppData\Local40208.exe
    3⤵
    PID:11132
- - C:\Users\Admin\AppData\Local26682.exe
    C:\Users\Admin\AppData\Local26682.exe
    3⤵
    PID:14448
- - C:\Users\Admin\AppData\Local54298.exe
    C:\Users\Admin\AppData\Local54298.exe
    3⤵
    PID:4896
- C:\Users\Admin\AppData\Local\Temp54146.exe
  C:\Users\Admin\AppData\Local\Temp54146.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:844
- - C:\Users\Admin\AppData\Local8167.exe
    C:\Users\Admin\AppData\Local8167.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData12754.exe
      C:\Users\Admin\AppData12754.exe
      4⤵
      PID:6336
    - - C:\Users\Admin38754.exe
        
        C:\Users\Admin38754.exe
        5⤵
        
        PID:7976
    - - C:\Users\Admin25188.exe
        
        C:\Users\Admin25188.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin15483.exe
        
        C:\Users\Admin15483.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin44151.exe
        
        C:\Users\Admin44151.exe
        5⤵
        
        PID:3476
  - - C:\Users\Admin\AppData21523.exe
      C:\Users\Admin\AppData21523.exe
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData57425.exe
      C:\Users\Admin\AppData57425.exe
      4⤵
      PID:11656
  - - C:\Users\Admin\AppData25319.exe
      C:\Users\Admin\AppData25319.exe
      4⤵
      PID:15280
  - - C:\Users\Admin\AppData37232.exe
      C:\Users\Admin\AppData37232.exe
      4⤵
      PID:16268
- - C:\Users\Admin\AppData\Local48743.exe
    C:\Users\Admin\AppData\Local48743.exe
    3⤵
    PID:5320
  - - C:\Users\Admin\AppData10487.exe
      C:\Users\Admin\AppData10487.exe
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData52153.exe
      C:\Users\Admin\AppData52153.exe
      4⤵
      PID:12536
  - - C:\Users\Admin\AppData35956.exe
      C:\Users\Admin\AppData35956.exe
      4⤵
      PID:15772
- - C:\Users\Admin\AppData\Local61788.exe
    C:\Users\Admin\AppData\Local61788.exe
    3⤵
    PID:6988
- - C:\Users\Admin\AppData\Local65017.exe
    C:\Users\Admin\AppData\Local65017.exe
    3⤵
    PID:11276
- - C:\Users\Admin\AppData\Local29403.exe
    C:\Users\Admin\AppData\Local29403.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14092
- - C:\Users\Admin\AppData\Local44030.exe
    C:\Users\Admin\AppData\Local44030.exe
    3⤵
    PID:17184
- C:\Users\Admin\AppData\Local\Temp3122.exe
  C:\Users\Admin\AppData\Local\Temp3122.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4504
- - C:\Users\Admin\AppData\Local58494.exe
    C:\Users\Admin\AppData\Local58494.exe
    3⤵
    PID:5988
  - - C:\Users\Admin\AppData46922.exe
      C:\Users\Admin\AppData46922.exe
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData59999.exe
      C:\Users\Admin\AppData59999.exe
      4⤵
      PID:11088
  - - C:\Users\Admin\AppData46018.exe
      C:\Users\Admin\AppData46018.exe
      4⤵
      PID:14372
  - - C:\Users\Admin\AppData65147.exe
      C:\Users\Admin\AppData65147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16248
- - C:\Users\Admin\AppData\Local12666.exe
    C:\Users\Admin\AppData\Local12666.exe
    3⤵
    PID:8172
- - C:\Users\Admin\AppData\Local43008.exe
    C:\Users\Admin\AppData\Local43008.exe
    3⤵
    PID:11164
- - C:\Users\Admin\AppData\Local51883.exe
    C:\Users\Admin\AppData\Local51883.exe
    3⤵
    PID:14440
- - C:\Users\Admin\AppData\Local12735.exe
    C:\Users\Admin\AppData\Local12735.exe
    3⤵
    PID:2432
- C:\Users\Admin\AppData\Local\Temp53986.exe
  C:\Users\Admin\AppData\Local\Temp53986.exe
  2⤵
  PID:5560
- - C:\Users\Admin\AppData\Local15698.exe
    C:\Users\Admin\AppData\Local15698.exe
    3⤵
    PID:10324
- - C:\Users\Admin\AppData\Local14384.exe
    C:\Users\Admin\AppData\Local14384.exe
    3⤵
    PID:14164
- - C:\Users\Admin\AppData\Local14165.exe
    C:\Users\Admin\AppData\Local14165.exe
    3⤵
    PID:17128
- C:\Users\Admin\AppData\Local\Temp13291.exe
  C:\Users\Admin\AppData\Local\Temp13291.exe
  2⤵
  PID:7236
- C:\Users\Admin\AppData\Local\Temp62305.exe
  C:\Users\Admin\AppData\Local\Temp62305.exe
  2⤵
  PID:10856
- C:\Users\Admin\AppData\Local\Temp56085.exe
  C:\Users\Admin\AppData\Local\Temp56085.exe
  2⤵
  PID:14228
- C:\Users\Admin\AppData\Local\Temp51151.exe
  C:\Users\Admin\AppData\Local\Temp51151.exe
  2⤵
  PID:3448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2504 -ip 2504
1⤵
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 7120 -ip 7120
1⤵
PID:15572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\31520.exe

Filesize
184KB

MD5
8b2acce2d3dcef10644e01302de4fcad

SHA1
6bc36ad83fe0869a588b415ffaa0d766ed7166ef

SHA256
4dfa34b5d8293c313f3fa9e4197c2044acf07573a13020bffab043f54ff1aa69

SHA512
76d962686bf9b7e17577c4694a78a14fb46b6867a16e106328e42fc0346975870976ba9543e85fb2dc6d232fb8ef469db3c35a637e57d74f00ab7bd0623fc10f

Download Submit
C:\40394.exe

Filesize
184KB

MD5
3f52013a094a96bf339624031ea75033

SHA1
d2e68c7f8406fb3c627af63bd53676d20f3e6688

SHA256
25e6109f875ac3ac92c4fd4e75714642ef88c5e2eb612a81e74c0854a3e8394d

SHA512
c9574116c59aa0609784be92b83a17b40e7cd6e2e78513230cac69b166ee5197a73654532a2eea568c035a03b654b182d0311a2e6c4767d9ec06229c49c00321

Download Submit
C:\44416.exe

Filesize
184KB

MD5
da7c7291ac9019f97205b14f5b6c8d0a

SHA1
53c31d1cc35b4b170aea02e0e83813bde46d9c2c

SHA256
adc57bff8ad3ab47b75f34f4936845edb01f4317e56c400607443802fa2ec8d2

SHA512
96cc73aa45e7fff9bfb7032b19e99c10d6caddd8c506b25d70e52fd99e3ac7a9dc01619ec56ef1cb367031c0eb6dd36bfb5cc7c48cdb6fa3046aa34e50d4b900

Download Submit
C:\8197.exe

Filesize
184KB

MD5
51025857cac1ead0f102dda8861fdefb

SHA1
83f968a6491a086357ad5845c790b6090329506b

SHA256
797ffb4116e01f9a5129d34ff2b9e2d3ec53205df2ac443d978696539b1285e9

SHA512
43e6795d920e4f9945615e30c1d43d8d110b2ee967ed5b756f1045ad89f93e74494e43513d0b2141edee3d76ece1db9a8774ddd7075b94396dfbb5a41e966c43

Download Submit
C:\Users19568.exe

Filesize
184KB

MD5
0e543bcbf6313b9c4a089fe2b887d02e

SHA1
b89964f00c9686a97a6d845c6db419ac703c0ae3

SHA256
0921b3137a7b2331543d554839982256f5e3f7ff5bf75832fc8c123a1612c6ef

SHA512
5dd9e15b3c3c2eba8965422428234ce1e4d97d5f569517eee23a4c0d27bf6ef64f5eb9a2ff4e14497e7a3b614b3b41bd3c7192fa20dae171303c0d535ddfd7d8

Download Submit
C:\Users57238.exe

Filesize
184KB

MD5
3bd79215ba22fed3c16055b93df551f6

SHA1
54ecf6a93f38f34937b380044041cd9a63ce4745

SHA256
d0805eb49287a3d38516dd6799a6ff980fb325a240d790befecc01b8179396a9

SHA512
c5c9b0a5155c80f1bada3c932b7df86ec1947b6124132dc2a5f9fe522b06f1766f469cdc013fc1a85fc4cec37fd26428291a1bb6afc5b13efb326a12826cda30

Download Submit
C:\Users\Admin12121.exe

Filesize
184KB

MD5
aed53ebca4f310654882a94e1633024c

SHA1
89e1a2e1dfd15781796ba1e885ed2a0850538923

SHA256
d8baea21a3d59330e346c653c7622559a56e79f9dcf6dc3ece5d62fce07f493d

SHA512
8811b8f1dd63575cf5d247c673532cec7f899a22ebfbadbedb69c4c2b600dacc77abfa0c158fc9a13cb77078b1ff2e213f3b77158fb50ee6121f78a43ee61a7d

Download Submit
C:\Users\Admin14814.exe

Filesize
184KB

MD5
e468d4c6aa98b1c7ba305d17b79b4012

SHA1
f76370e225f46114f04b90c198410802d7df9174

SHA256
1ad460ba7377bb353370249240299cc93a4ad96ff269a76af2d7a100d73f978b

SHA512
8f31e56d2a60e36149e8f77d5992247edf504507449ddd0b015cd7f035b7e09b35b52314ed02bcaf66cff38adf48da8716040666d68f802b21ff42afed956a01

Download Submit
C:\Users\Admin16206.exe

Filesize
184KB

MD5
2109d51425e7bbc17a093973fd3a02fd

SHA1
e41cada0b68e7886cf57fc86648cd8420541bbbe

SHA256
68a9abc2843e7944f56af41bb6e95ab17867d52c14756826175e1855dbc10e3a

SHA512
d989a389d78dcebbc691076e14e9b62e25e0ca70670ba571cff3f24272dec5d73d996a1264fa2a42a23b08666229f8c09598523a3d2d05b2536288043f23f4ea

Download Submit
C:\Users\Admin40710.exe

Filesize
184KB

MD5
2e8395fd65f0a7fee2a7fd774c4d5013

SHA1
03c9285cabd8968d84fc1b225d5cf841a4279108

SHA256
1dc9c035df1b350344419b9b23808153fb115cc4a5d0fff06343b43c2602260a

SHA512
306e737bbc85a339eee72881bec2f3a6a672bd60ce4ca71b85a187d54791caf10212562b9497d07cc8f50e830e6c317ab5c78d98b7b91c7ce396392aa9944021

Download Submit
C:\Users\Admin7871.exe

Filesize
184KB

MD5
4e256d9dff3379f076f2ba4824974760

SHA1
32a8585ba5be966e86fb1315ecd50f581ae4d328

SHA256
c619237bf7ec9bb8cfcc289bb1cbd4d465de56826ed6c0494efacc661a26f5e1

SHA512
2dfa7298adf7de41a3aa5909b2b6469b391ccd7ee1151233006172ad2689095f749347570652c1b1d7321889b1bc9102b7496291106dd073766f862131c34ea4

Download Submit
C:\Users\Admin\AppData20892.exe

Filesize
184KB

MD5
27ea5c8292455ff9ac2825d88dc48524

SHA1
644f1b839499ed29aeb854c1efddd73133c0abec

SHA256
0eb0fd0ee6ec67b04777f942af13bf4efa363bfb9099a6a8d1bc2f496e56312e

SHA512
5e55b22c1beb2089739858f7db7769227898caa5c14b49844c2e49ea534b7183a59896c85b0133b068b05432ac30a7ab2515ee5ebfadb89384e250593d8a3ee0

Download Submit
C:\Users\Admin\AppData25634.exe

Filesize
184KB

MD5
7bef480444961de3e87bbd54c576f3b3

SHA1
c72aa00275e3151dd15b91fe914d9162e0b8dcc1

SHA256
2cb9aea63fc774f1c7f21109d0ff8a4e56eaac88096edad81d1f0b146324dacf

SHA512
0e2c67677840f04f3b31fcdebcf1ddf0fd0c498a00cd5675745ca8358ecff2a2fb02eb3f67a88fb3b5d44da6ff0dbe0623196ada392b46e1f6b237bb2e1b0292

Download Submit
C:\Users\Admin\AppData29012.exe

Filesize
184KB

MD5
80d7c10e7844638a0290111cd6299de3

SHA1
b822a2b74ae6ac5ecfeb6d38ce746af3ac9fe169

SHA256
df4ad19bdb4624656f8ff65468dbe0d050b736461210a20a672533cc9bebb75c

SHA512
2fb12b8606e43c5209b874d57f0d501b4db390cb28a3e8538250244b152664a2fcbee950cca6751acf726299c82d45c8c1abacc968c0c3389a30312e78ecd30f

Download Submit
C:\Users\Admin\AppData30404.exe

Filesize
184KB

MD5
053e1d43e77ff803b41686d6ce99417a

SHA1
786de4ccb21ea9810592d48d8a08516bfe55601e

SHA256
8813a404ce98e3518e7d905de2143b6f80604433b421f0425539b6cbc316c511

SHA512
7cf5c05bec3b920fe477c8c140257e25164326535654c20abbc4edb0e68bd963c9f1cdf71cf183bf0efad19b9b437de5d50ff4d24c2c3ffa7bfb5f12ff6fb3d8

Download Submit
C:\Users\Admin\AppData42656.exe

Filesize
184KB

MD5
dd74a5020f71abff03e188b4b0087840

SHA1
5db266008be16c124c4f9d985a9634f2c41e8f1d

SHA256
14c5be61618fb990c6012d465114ced908e530a040c8f6d08637077ac1d42e60

SHA512
853f0bacaa91f8deb747566e82798b81a0e37d2394e39313fa307015f6b8822996df065eef8fdd1e5dd6c4789169a86bfcfc7e5a5273e52e8749a2ee950be960

Download Submit
C:\Users\Admin\AppData43402.exe

Filesize
184KB

MD5
5f347c5df2fbd468a9aed86cf681d0ac

SHA1
d576480647d4097cb99403466d38102a4f002efd

SHA256
2182c738e59ec513cd2fa5abd78aa4f2d64b03e8a3cb8b19abca99b0bfe624c8

SHA512
4d581c34b74ecb9c43546fda456f754eac7b6495f65b50d734d04555ed85e0dfceacac63cdf2c301f363ed5093799cdaf80b5dcebfab53e06ace0f795ba57eec

Download Submit
C:\Users\Admin\AppData50824.exe

Filesize
184KB

MD5
535baf5e85cae5c8ff3d4b277d064e58

SHA1
443755ec17cdb771101fdfe28ba314b5dbe4b7ca

SHA256
9786f301ada80d75eb7ee939ad6ed2eef3e98d031f5ed5e7b7313b52f8ce847d

SHA512
cc7698ae7e4c18a9c21add184aa00861e3ce7154802236005f46f796003b239796b3a19d9abb5ab62f428785b5aba22cee1e2500ed44ce9d0a22b0e61a27cc17

Download Submit
C:\Users\Admin\AppData56112.exe

Filesize
184KB

MD5
88f2d8299006d3d2afd3f975e48eabce

SHA1
751172ebe12c3896548f1ea01b6a0ce30d1bb322

SHA256
6e77537b35ae5edfb577fd5f8a0481ac9b1d0fd6c02e77fe81bab485e6677d94

SHA512
d2eda46e44d23114bf7c3675cee89e8a139b1158b31eae6c75651b4be1a67c00a2ff1368486b5cb43bf33532cfb0ef80168dcd3b0ad911fcc882a81af6b36d58

Download Submit
C:\Users\Admin\AppData57138.exe

Filesize
184KB

MD5
16fb5f1e935db4c82b85fcb7c455cd30

SHA1
58b55d85465ab297b2a992d07fb05c5e9b40510b

SHA256
4ccd5748fc9e01ef5f9db26a4035126093267a4f6f5192cb67a21be768b204ef

SHA512
fd51ad69b1b472e1226acbd7dbb557c72842d31b6d607cea807e9a22401ae6f271c47cdb609c023b90b226f53f8a218e06233dd5c5dfddcab8277395bf461dc1

Download Submit
C:\Users\Admin\AppData59786.exe

Filesize
184KB

MD5
f7cd6c2f694d822c5996b678648f632b

SHA1
f4d147adad2af5918a35694c965faf2d0b44906c

SHA256
70f38391a3087f883e4414c6e95936cfb805f9a1ab4bfa7af071ee10b0c95b4f

SHA512
56401cdff15fab2d4c28699873de9d5b2adc7ae987aaacba685cab5349ad464ecb6bfcb053d206e7cf2be5ea5366b8729377ee35e48855697c195a37c5faeffe

Download Submit
C:\Users\Admin\AppData61711.exe

Filesize
184KB

MD5
fa373f978db770978c820886d7a10e5b

SHA1
f241164eb303ab925ccf2d80ba008466ddeb273a

SHA256
995f76eaf63696ed1b47be813990663a412647b46b68b8d524fc833c6131b9f5

SHA512
33501615e6042c540586a86df3fd6b751b36c947f5647fa6d8becc591d2cb8da3a9bd16aed77b5501573c0cc2e6db5de9bef4055347d89d4ce0af81913dc8557

Download Submit
C:\Users\Admin\AppData\Local18204.exe

Filesize
184KB

MD5
cff79c9cdc710110040bc056e89d653d

SHA1
e9d551227e71b882cb4a15cd19ad94d4230caccb

SHA256
f9cf47fcb40a5a1aa5dbc4dfdb19b9e257cd52a5a522665b997269a8259ab585

SHA512
d0f8ec485df9cd9254d8a2f2b4433cf5f3cd515800d79a99a8c0f486071f1516868ac4b6f246cb47550980111146da2bc6a71bf7f7cad9c7e2fdab835cb24949

Download Submit
C:\Users\Admin\AppData\Local2827.exe

Filesize
184KB

MD5
b1cd0eb63af596fb9deed3d446a02760

SHA1
df97daf1f1b8b2d80ff6899674e0c2d14b30a26a

SHA256
67e09fb5308b0ce9cfc5f49c3b891e19be0832fdfb3681b77f3586d3bde39ba0

SHA512
0ea6f24fe9a7ad4cd3c9910eef638bcfc3f7726c2794b25e779f86a12f034ba5b63b48953c5354f32f93b20793c71f0a6610b7d1e35c231fca185cefd6a5be0d

Download Submit
C:\Users\Admin\AppData\Local31097.exe

Filesize
184KB

MD5
933d8de96257af475251825d976a5206

SHA1
28c2275eaedbf0dd3a0599e2cc39f2fe36f724bd

SHA256
58a2c396e5d1966a3f7530bd3ee5cd3b3acfbf63625b58f05d5da1d5cbd080af

SHA512
1b7fe4123169222d5c10b7172bed43bd3fd59714a141b13a0a5ceac9cf2bbda39771c163c71d213007c3f2c3d10a50612d36db0a4750db9f7025d99a83fa130e

Download Submit
C:\Users\Admin\AppData\Local36526.exe

Filesize
184KB

MD5
b307537f3d098a4b058d7e7526c3b89a

SHA1
f581ce9bd634577d98533d36b2d2bafd32bb9e79

SHA256
660824bd1d92de426450641a52c22dcc53897f4063ff9f89d9d9f255a1babd8b

SHA512
6e6164c442a0841abf9b192484c8fd3720b52fdfa11ebfc45176d4dfafe9a247e64c56e390bf59ea9b794550c0e5b457e403101719f40451429923fbc7179ea9

Download Submit
C:\Users\Admin\AppData\Local39126.exe

Filesize
184KB

MD5
94698b9c0a43e432d36c03c3e9a527c4

SHA1
09388ae1ad56dcd6f3798fb74e6ae2c4ef7a63fe

SHA256
e6769b221b6d9532a574cfb8267ba10c0d084a41fa412a2613f970dcc49b6141

SHA512
bbbe8f97d87410be49eeb0d096aaca54e636847ca05122efdcc45e78dfe734bda69fc4812cd208ed9c6e098615936eede451cb2792de654c532fa471a16f276c

Download Submit
C:\Users\Admin\AppData\Local39920.exe

Filesize
184KB

MD5
3223c3fdcedd62a7fce96df1fb124fd5

SHA1
021b46c08aed5a010fb55519a392b32cb953ac8a

SHA256
bb9e767509680a6c4567ec1df1ff08d9df16e51876138ee0fd85b3fa5695dfbe

SHA512
37ad2606b2061c8a33081549008b7e76b98734da451f3af3725de1e997123b586d5ac7af0a9742025bf91330fa89ccfce6635c5049c80cf167c6e89ccb9523a5

Download Submit
C:\Users\Admin\AppData\Local40330.exe

Filesize
184KB

MD5
40bef87b90ca574f16875b2efc411bc7

SHA1
a618486c2b11ae819ddf041828e1d3477bf32cd8

SHA256
26c721267eb27adcc7d69de50e1f80a0011b8af2f4c0327ee6957ba4df6eba46

SHA512
c866e2e34701a3d11cab9322d17fc6ffc63dba428012d265f078612b59275af84b2cc29cd77f8ca8de5550e81fb9e673b4818bccb4cb3ab682d7775dbd1455b4

Download Submit
C:\Users\Admin\AppData\Local54643.exe

Filesize
184KB

MD5
70ce2f87d8ea6ecf3501a34fd6c8163a

SHA1
15a7b54795d28db4fc4dbe148d69d470426d678d

SHA256
dc54f1ed914ac245e5061e9cf4dda9357401ffc20bda49cab5739151d7ebacc4

SHA512
1f180d4a2c0f623134ade2164469e4b9b2767765810d846aa6de86c1d5366ec07c157078319e590bf0455d289e1fb152618e35f76c2d31181899a1be245db053

Download Submit
C:\Users\Admin\AppData\Local54908.exe

Filesize
184KB

MD5
72fd17a98adb80239c327310e1fa8532

SHA1
b13f004f3968e7aee9727873d7a60ca1c5b642ab

SHA256
56f2721d4789c697416ac46a2abef5988e389eabb4a90621c7e2f2c4b8511cf5

SHA512
5275c6307d0c06281ca865903ce563d44c910f3e68a587ba6251dcf72d487737155ce42982d4fa967ee55cfe7804fe2f92d02b58b03120418b946a8719f499dd

Download Submit
C:\Users\Admin\AppData\Local59786.exe

Filesize
184KB

MD5
0681c8ef0723e9cbfb35556d632d7c4c

SHA1
db5bd451a3de7c92ae0cd9ae9c997702a9b43ac9

SHA256
12250fee34c5ff3fd917a97c4fd5b3f2e5352cff300305a6126eccc1e38718fe

SHA512
3501e4304e542bd8db4bb5837aabc2799f351df62eba2c15ea6a0b55455248eda4ef297a04c7296e891224dc9177925ce217f03f5438d0c3d0e6da4990373688

Download Submit
C:\Users\Admin\AppData\Local\Temp31507.exe

Filesize
184KB

MD5
456f068b7ea3ab60eee98252db8c4a00

SHA1
d260c1ce4fca90ccd5a3b8c5580e048cb6b8b434

SHA256
82445913a7c9a29f5a296ecb53de138647e8628b5181dac68518df4a38261480

SHA512
d2dee34ca520148cb1f9b3d73db6e497ed41a7aeae789838d1c7dd70bfe1f9b2b0f9feabd79a54b002975ddc726d79f9a1301090e59dc099d9031d68ccf1e982

Download Submit
C:\Users\Admin\AppData\Local\Temp33148.exe

Filesize
184KB

MD5
6a3be7956c76edebcbda38789492df47

SHA1
a147f8e660a0a9efd51989baa6f3c8c574fce3b0

SHA256
f3ef5255ffce4a417a75699b64936b2a03f86c1e6861041eb7544c8b6b7834d3

SHA512
71d030a14756f6c603da123bcb056f03b410aa3f34fed47811ffcd173e823e1a5fbe7426c54783cc1e8d5f6f301bccc7b9bebe317138f6a05a8f20cdb6f92bd3

Download Submit
C:\Users\Admin\AppData\Local\Temp36963.exe

Filesize
184KB

MD5
cdee0a03c4e438a440dc079fca2fd521

SHA1
13419cf5f78485299ff303358af09bf49d96664e

SHA256
6265e58be4374abb0056853c7d1b0cf193db5f8e79b7eace3b24bc3a18bd495f

SHA512
01fe86906522b1c13ce0a5ee52cbf84b605a1f0ccc60f37a6c28047618b3d76e1cbc0dd18aeef99651505bd69488398c7c0994fe0243680cd40e669d5972604d

Download Submit
C:\Users\Admin\AppData\Local\Temp53232.exe

Filesize
184KB

MD5
92d1a317faf12cb2e8974751cae466f9

SHA1
601c0764bd4da2fc2cb98c58c86a3a722204df17

SHA256
472e596216bacc8e0a0034019cf42418a02fa7fbcde8bf4c1d9cb405eb6c5eda

SHA512
2bd3af27a636fff1b1556b210d32b242f23b9a3bd48c560b6f74011dba8163940e765bd7f691ad61cc8ea915915df9c2775f2cda560a8a965aeb1570318457b2

Download Submit
C:\Users\Admin\AppData\Local\Temp54146.exe

Filesize
184KB

MD5
fe59b79d765e4ce07a05a902502074bc

SHA1
472c8b8c56496a96cec945b63143136dc5874a58

SHA256
15a551e7fef99ed87c2b931861dbb3a11ed12b083f3b06f24d4697debd2f0cb3

SHA512
9d8092072ced6641ad4989fad40ff2a62f32a5f06227def676a76f1181ed5f5e990f329e04a21acacca1a5d49855b9988613885259a085f04ea9f402682edf1b

Download Submit