hawkeye | 38bc13ef112b2f17d4d1a80243fac6a521b5d58228984aae0752d79487fa3b66

Resubmissions

16/04/2025, 11:04

250416-m58gsaz1ay 10

15/04/2025, 17:34

15/04/2025, 06:16

14/04/2025, 08:06

14/04/2025, 07:59

14/04/2025, 07:22

14/04/2025, 07:16

11/04/2025, 21:39

Analysis

max time kernel
641s
max time network
455s
platform
windows11-21h2_x64
resource
win11-20250410-en
resource tags

arch:x64arch:x86image:win11-20250410-enlocale:en-usos:windows11-21h2-x64system
submitted
15/04/2025, 17:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c01b007729230c415420ad641ad92eb.exe
Size

1.3MB
MD5

daef338f9c47d5394b7e1e60ce38d02d
SHA1

c0a07e8c32528d29aae26aaecbf6a67ed95b8c8e
SHA256

5d03fd083b626a5516194d5e94576349100c9c98ca7d6845642ed9579980ca58
SHA512

d0f4050fc2c5f38ab598729fb6930c84bf779d47b5a8b4e860bc0e9ca8be454ad5dce001d8f88299d8a079eafd4c26efcdd2d196352acfe45e940cc107fcebf4
SSDEEP

24576:W85y6Jwdt8jtWoJpXWHALGX+C1Co3aP8jvuC7g6zwm4m53Sb21SR:HXsSGuC/MIvuC5kFm53Sy1SR

Score

10^/10

hawkeye collection discovery keylogger persistence spyware stealer trojan

Malware Config

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
Hawkeye family
hawkeye

Detected Nirsoft tools 7 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
behavioral10/memory/5812-102-0x0000000000400000-0x0000000000484000-memory.dmp	Nirsoft
behavioral10/memory/2656-109-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral10/memory/2656-108-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral10/memory/2656-110-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral10/memory/2432-112-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral10/memory/2432-111-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral10/memory/2432-118-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

NirSoft MailPassView 4 IoCs

Password recovery tool for various email clients

resource	yara_rule
behavioral10/memory/5812-102-0x0000000000400000-0x0000000000484000-memory.dmp	MailPassView
behavioral10/memory/2656-109-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral10/memory/2656-108-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral10/memory/2656-110-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 4 IoCs

Password recovery tool for various web browsers

resource	yara_rule
behavioral10/memory/5812-102-0x0000000000400000-0x0000000000484000-memory.dmp	WebBrowserPassView
behavioral10/memory/2432-112-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral10/memory/2432-111-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral10/memory/2432-118-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Executes dropped EXE 64 IoCs

pid	Process
4820	odm.exe
5020	odm.exe
3596	odm.exe
3980	odm.exe
4764	odm.exe
2864	odm.exe
236	odm.exe
5592	odm.exe
5072	odm.exe
5028	odm.exe
4048	odm.exe
3624	odm.exe
3744	odm.exe
3140	odm.exe
1116	odm.exe
5236	odm.exe
5456	odm.exe
5988	odm.exe
5816	odm.exe
4672	odm.exe
3816	odm.exe
684	odm.exe
3332	odm.exe
3076	odm.exe
1584	odm.exe
1644	odm.exe
5276	odm.exe
4724	odm.exe
4744	odm.exe
5668	odm.exe
4656	odm.exe
2052	odm.exe
5148	odm.exe
5196	odm.exe
5248	odm.exe
1388	odm.exe
404	odm.exe
2988	odm.exe
3052	odm.exe
960	odm.exe
6036	odm.exe
2808	odm.exe
4148	odm.exe
2120	odm.exe
2068	odm.exe
6092	odm.exe
1484	odm.exe
3140	odm.exe
3360	odm.exe
4912	odm.exe
5584	odm.exe
2036	odm.exe
5404	odm.exe
5988	odm.exe
4564	odm.exe
4628	odm.exe
1132	odm.exe
2552	odm.exe
416	odm.exe
872	odm.exe
5936	odm.exe
956	odm.exe
424	odm.exe
2016	odm.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-599783296-1627459723-2423478968-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	odm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\wou\\odm.exe C:\\Users\\Admin\\AppData\\Roaming\\wou\\kja-pex"	RegSvcs.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	whatismyipaddress.com
3	whatismyipaddress.com

Suspicious use of SetThreadContext 64 IoCs

description	pid	Process	procid_target
PID 3596 set thread context of 5812	3596	odm.exe	87
PID 3596 set thread context of 2556	3596	odm.exe	88
PID 5812 set thread context of 2656	5812	RegSvcs.exe	90
PID 5812 set thread context of 2432	5812	RegSvcs.exe	91
PID 5592 set thread context of 1900	5592	odm.exe	100
PID 5592 set thread context of 2076	5592	odm.exe	101
PID 4048 set thread context of 4160	4048	odm.exe	109
PID 4048 set thread context of 5728	4048	odm.exe	110
PID 3744 set thread context of 2172	3744	odm.exe	118
PID 3744 set thread context of 2980	3744	odm.exe	119
PID 5456 set thread context of 548	5456	odm.exe	127
PID 5456 set thread context of 2396	5456	odm.exe	128
PID 5816 set thread context of 4992	5816	odm.exe	137
PID 5816 set thread context of 4600	5816	odm.exe	138
PID 1584 set thread context of 4544	1584	odm.exe	147
PID 1584 set thread context of 5024	1584	odm.exe	148
PID 5276 set thread context of 5936	5276	odm.exe	157
PID 5276 set thread context of 2200	5276	odm.exe	158
PID 5148 set thread context of 5676	5148	odm.exe	167
PID 5148 set thread context of 3256	5148	odm.exe	168
PID 5248 set thread context of 6048	5248	odm.exe	177
PID 5248 set thread context of 5216	5248	odm.exe	179
PID 6036 set thread context of 3700	6036	odm.exe	190
PID 6036 set thread context of 5852	6036	odm.exe	192
PID 4148 set thread context of 2356	4148	odm.exe	202
PID 4148 set thread context of 656	4148	odm.exe	204
PID 3360 set thread context of 676	3360	odm.exe	214
PID 3360 set thread context of 2708	3360	odm.exe	215
PID 5584 set thread context of 820	5584	odm.exe	224
PID 5584 set thread context of 2456	5584	odm.exe	225
PID 1132 set thread context of 4280	1132	odm.exe	234
PID 1132 set thread context of 1624	1132	odm.exe	237
PID 416 set thread context of 3424	416	odm.exe	246
PID 416 set thread context of 5616	416	odm.exe	247
PID 3636 set thread context of 4820	3636	odm.exe	256
PID 3636 set thread context of 5020	3636	odm.exe	257
PID 5424 set thread context of 236	5424	odm.exe	266
PID 5424 set thread context of 4948	5424	odm.exe	267
PID 2060 set thread context of 5992	2060	odm.exe	276
PID 2060 set thread context of 3252	2060	odm.exe	277
PID 2692 set thread context of 2948	2692	odm.exe	286
PID 2692 set thread context of 2008	2692	odm.exe	287
PID 5220 set thread context of 3624	5220	odm.exe	296
PID 5220 set thread context of 772	5220	odm.exe	297
PID 2288 set thread context of 4932	2288	odm.exe	306
PID 2288 set thread context of 1340	2288	odm.exe	307
PID 920 set thread context of 4868	920	odm.exe	316
PID 920 set thread context of 480	920	odm.exe	318
PID 1768 set thread context of 1540	1768	odm.exe	331
PID 1768 set thread context of 6084	1768	odm.exe	332
PID 4964 set thread context of 4336	4964	odm.exe	340
PID 4964 set thread context of 956	4964	odm.exe	342
PID 956 set thread context of 4236	956	RegSvcs.exe	347
PID 956 set thread context of 1912	956	RegSvcs.exe	348
PID 4636 set thread context of 4076	4636	odm.exe	362
PID 4636 set thread context of 5952	4636	odm.exe	363
PID 5952 set thread context of 5308	5952	RegSvcs.exe	375
PID 5348 set thread context of 3684	5348	odm.exe	378
PID 5952 set thread context of 2008	5952	RegSvcs.exe	376
PID 5348 set thread context of 2988	5348	odm.exe	379
PID 2988 set thread context of 2728	2988	RegSvcs.exe	386
PID 2988 set thread context of 2120	2988	RegSvcs.exe	387
PID 2104 set thread context of 1560	2104	odm.exe	400
PID 2104 set thread context of 1828	2104	odm.exe	402

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
2236	6048	WerFault.exe	177
5664	3700	WerFault.exe	190
2692	2356	WerFault.exe	202
1436	4280	WerFault.exe	234
1652	4868	WerFault.exe	316
5012	4336	WerFault.exe	340
388	1560	WerFault.exe	400
5236	3884	WerFault.exe	423
4776	2008	WerFault.exe	445
5244	5200	WerFault.exe	493
1004	4048	WerFault.exe	543
3068	4048	WerFault.exe	543
3404	4908	WerFault.exe	650
2616	5568	WerFault.exe	662
3148	5244	WerFault.exe	705
6468	6428	WerFault.exe	781
6468	232	WerFault.exe	816
1492	4884	WerFault.exe	847
3080	6048	WerFault.exe	855
4724	4516	WerFault.exe	871
6304	6180	WerFault.exe	890
7000	6560	WerFault.exe	920
7448	7216	WerFault.exe	957
7648	7580	WerFault.exe	970
4604	6324	WerFault.exe	1008
6272	5864	WerFault.exe	1023
3444	1628	WerFault.exe	1042
1364	7872	WerFault.exe	1089
3192	2144	WerFault.exe
6808	6732	WerFault.exe	1167
5948	7972	WerFault.exe	1309

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvcs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odm.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4820	odm.exe
4820	odm.exe
5020	odm.exe
5020	odm.exe
2432	vbc.exe
2432	vbc.exe
4764	odm.exe
4764	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe
2864	odm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5812	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4820	3020	2c01b007729230c415420ad641ad92eb.exe	78
PID 3020 wrote to memory of 4820	3020	2c01b007729230c415420ad641ad92eb.exe	78
PID 3020 wrote to memory of 4820	3020	2c01b007729230c415420ad641ad92eb.exe	78
PID 3020 wrote to memory of 5020	3020	2c01b007729230c415420ad641ad92eb.exe	81
PID 3020 wrote to memory of 5020	3020	2c01b007729230c415420ad641ad92eb.exe	81
PID 3020 wrote to memory of 5020	3020	2c01b007729230c415420ad641ad92eb.exe	81
PID 4820 wrote to memory of 3596	4820	odm.exe	82
PID 4820 wrote to memory of 3596	4820	odm.exe	82
PID 4820 wrote to memory of 3596	4820	odm.exe	82
PID 5020 wrote to memory of 3980	5020	odm.exe	83
PID 5020 wrote to memory of 3980	5020	odm.exe	83
PID 5020 wrote to memory of 3980	5020	odm.exe	83
PID 3276 wrote to memory of 4764	3276	cmd.exe	86
PID 3276 wrote to memory of 4764	3276	cmd.exe	86
PID 3276 wrote to memory of 4764	3276	cmd.exe	86
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 5812	3596	odm.exe	87
PID 3596 wrote to memory of 2556	3596	odm.exe	88
PID 3596 wrote to memory of 2556	3596	odm.exe	88
PID 3596 wrote to memory of 2556	3596	odm.exe	88
PID 3596 wrote to memory of 2556	3596	odm.exe	88
PID 3596 wrote to memory of 2556	3596	odm.exe	88
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2656	5812	RegSvcs.exe	90
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 5812 wrote to memory of 2432	5812	RegSvcs.exe	91
PID 4764 wrote to memory of 2864	4764	odm.exe	92
PID 4764 wrote to memory of 2864	4764	odm.exe	92
PID 4764 wrote to memory of 2864	4764	odm.exe	92
PID 3032 wrote to memory of 236	3032	cmd.exe	95
PID 3032 wrote to memory of 236	3032	cmd.exe	95
PID 3032 wrote to memory of 236	3032	cmd.exe	95
PID 236 wrote to memory of 5592	236	odm.exe	96
PID 236 wrote to memory of 5592	236	odm.exe	96
PID 236 wrote to memory of 5592	236	odm.exe	96
PID 4884 wrote to memory of 5072	4884	cmd.exe	99
PID 4884 wrote to memory of 5072	4884	cmd.exe	99
PID 4884 wrote to memory of 5072	4884	cmd.exe	99
PID 5592 wrote to memory of 1900	5592	odm.exe	100
PID 5592 wrote to memory of 1900	5592	odm.exe	100
PID 5592 wrote to memory of 1900	5592	odm.exe	100
PID 5592 wrote to memory of 1900	5592	odm.exe	100
PID 5592 wrote to memory of 1900	5592	odm.exe	100
PID 5592 wrote to memory of 1900	5592	odm.exe	100

C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe
"C:\Users\Admin\AppData\Local\Temp\2c01b007729230c415420ad641ad92eb.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QRPML
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5812
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
        5⤵
        Accesses Microsoft Outlook accounts
        
        PID:2656
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
        
        C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2432
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\QRPML
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  "C:\Users\Admin\AppData\Roaming\wou\odm.exe" kja-pex
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QRPML
    3⤵
    - Executes dropped EXE
    PID:3980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FASGO
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:2864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZWMIR
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1900
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\ZWMIR
      4⤵
      PID:2076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5072
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PUBFG
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4048
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4160
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\PUBFG
      4⤵
      PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3252
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5028
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DDGRQ
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:3744
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2172
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\DDGRQ
      4⤵
      PID:2980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1244
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3624
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FYHUL
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    PID:5456
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:548
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FYHUL
      4⤵
      PID:2396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5648
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3140
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZOMGH
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5816
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\ZOMGH
      4⤵
      PID:4600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:772
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1116
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZOMGH
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5584
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5236
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UWZKV
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5672
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5988
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\TQXOS
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1584
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4544
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\TQXOS
      4⤵
      Adds Run key to start application
      PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4664
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:3816
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CRHMC
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5276
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5936
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\CRHMC
      4⤵
      System Location Discovery: System Language Discovery
      PID:2200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3448
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:684
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CRHMC
    3⤵
    - Executes dropped EXE
    PID:4724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5056
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:3076
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UIDKE
    3⤵
    - Executes dropped EXE
    PID:4656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1940
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:1644
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UAUIX
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5148
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5676
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\UAUIX
      4⤵
      System Location Discovery: System Language Discovery
      PID:3256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3020
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:4744
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KFDXK
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5248
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 96
        5⤵
        Program crash
        
        PID:2236
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\KFDXK
      4⤵
      PID:5216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4916
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5668
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KFDXK
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1928
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2052
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HUABX
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3052

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4852
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5196
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LXXVI
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:6036
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3700
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3700 -s 92
        5⤵
        Program crash
        
        PID:5664
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\LXXVI
      4⤵
      Adds Run key to start application
      PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3740
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1388
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\EQNFU
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:4148
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2356
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2356 -s 92
        5⤵
        Program crash
        
        PID:2692
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\EQNFU
      4⤵
      PID:656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3100
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2988
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\EQNFU
    3⤵
    - Executes dropped EXE
    PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6048 -ip 6048
1⤵
PID:1148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5620
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:960
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CYOBP
    3⤵
    - Executes dropped EXE
    PID:1484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4160
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2808
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IZYIZ
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:3360
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:676
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\IZYIZ
      4⤵
      PID:2708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3700 -ip 3700
1⤵
PID:452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:412
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2120
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YIMYN
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5584
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:820
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YIMYN
      4⤵
      PID:2456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2108
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:6092
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YIMYN
    3⤵
    - Executes dropped EXE
    PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2356 -ip 2356
1⤵
PID:2812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2440
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:3140
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WSFWF
    3⤵
    - Executes dropped EXE
    PID:4564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3368
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:4912
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HMBQT
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:1132
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4280
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 92
        5⤵
        Program crash
        
        PID:1436
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\HMBQT
      4⤵
      Adds Run key to start application
      PID:1624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5548
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2036
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FXWMO
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:416
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3424
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FXWMO
      4⤵
      PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4600
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:5988
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FXWMO
    3⤵
    - Executes dropped EXE
    PID:5936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2404
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:4628
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\OKZIE
    3⤵
    - Executes dropped EXE
    PID:424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5412
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2552
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LHQLA
    3⤵
    - Suspicious use of SetThreadContext
    PID:3636
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4820
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\LHQLA
      4⤵
      Adds Run key to start application
      PID:5020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4280 -ip 4280
1⤵
PID:1720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5572
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:872
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WFLRU
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5424
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:236
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\WFLRU
      4⤵
      PID:4948

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5296
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:956
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WFLRU
    3⤵
    PID:2332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5836
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - Executes dropped EXE
  PID:2016
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KCFPB
    3⤵
    - Adds Run key to start application
    PID:1192

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2500
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4004
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PJRTP
    3⤵
    - Suspicious use of SetThreadContext
    PID:2060
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\PJRTP
      4⤵
      PID:3252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5264
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2244
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YXSUZ
    3⤵
    - Suspicious use of SetThreadContext
    PID:2692
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2948
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YXSUZ
      4⤵
      PID:2008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5396
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5216
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YXSUZ
    3⤵
    PID:5640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4764
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1872
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PBVIL
    3⤵
    PID:4800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3704
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2988
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WZITF
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5220
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3624
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\WZITF
      4⤵
      PID:772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3484
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5620
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZIGTC
    3⤵
    - Suspicious use of SetThreadContext
    PID:2288
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4932
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\ZIGTC
      4⤵
      PID:1340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2728
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1760
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZIGTC
    3⤵
    PID:2064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4160
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5408
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QTHVM
    3⤵
    PID:1448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3500
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:784
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\MCTLQ
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:920
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4868
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4868 -s 92
        5⤵
        Program crash
        
        PID:1652
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\MCTLQ
      4⤵
      Adds Run key to start application
      PID:480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3292
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4844
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SEZKX
    3⤵
    - Suspicious use of SetThreadContext
    PID:1768
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1540
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\SEZKX
      4⤵
      System Location Discovery: System Language Discovery
      PID:6084

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1628
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5724
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PTQYU
    3⤵
    - Adds Run key to start application
    PID:1332

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2756
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4604
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\JIPCY
    3⤵
    - Suspicious use of SetThreadContext
    PID:4964
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4336
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4336 -s 92
        5⤵
        Program crash
        
        PID:5012
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\JIPCY
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      PID:956
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:4236
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\JIPCY
        5⤵
        
        PID:1912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5972
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2036
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BBJHJ
    3⤵
    PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4868 -ip 4868
1⤵
PID:4036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4696
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3004
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UPCAL
    3⤵
    - Suspicious use of SetThreadContext
    PID:4636
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4076
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\UPCAL
      4⤵
      Adds Run key to start application
      Suspicious use of SetThreadContext
      PID:5952
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:5308
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\UPCAL
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4628
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2612
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UDWNC
    3⤵
    PID:764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6060
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4560
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UDWNC
    3⤵
    PID:4228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:460
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1376
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IRMWN
    3⤵
    PID:108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5208
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2984
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BIERI
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:5348
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3684
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\BIERI
      4⤵
      Suspicious use of SetThreadContext
      PID:2988
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:2728
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\BIERI
        5⤵
        
        PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4336 -ip 4336
1⤵
PID:4876

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3988
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4504
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KLSVI
    3⤵
    PID:4828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3276
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3080
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YHDDP
    3⤵
    - Adds Run key to start application
    PID:400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2992
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3264
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NNDJF
    3⤵
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    PID:2104
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 92
        5⤵
        Program crash
        
        PID:388
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NNDJF
      4⤵
      PID:1828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3012
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1244
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NNDJF
    3⤵
    PID:4156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:404
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5820
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HIVSN
    3⤵
    PID:4936

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3572
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2300
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HIVSN
    3⤵
    PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2304
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5100
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HIVSN
    3⤵
    PID:5392

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2264
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3360
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VNLXD
    3⤵
    PID:5012
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1644
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\VNLXD
      4⤵
      PID:4948
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:3884
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3884 -s 92
        6⤵
        Program crash
        
        PID:5236
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\VNLXD
        5⤵
        
        PID:4976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5528
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5340
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NXMQK
    3⤵
    PID:5068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3560
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4840
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\TOTDD
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5432
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5884
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UDIRW
    3⤵
    - Adds Run key to start application
    PID:3968
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3512
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\UDIRW
      4⤵
      Adds Run key to start application
      PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1560 -ip 1560
1⤵
PID:4868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:680
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4576
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NAZSH
    3⤵
    - Adds Run key to start application
    PID:2640
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2008
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 92
        5⤵
        Program crash
        
        PID:4776
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NAZSH
      4⤵
      PID:4772
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:3352
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\NAZSH
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1996
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:644
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\GNCYY
    3⤵
    - Adds Run key to start application
    PID:4452

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1196
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5928
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SAELK
    3⤵
    - Adds Run key to start application
    PID:3244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2024
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1648
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FDWSS
    3⤵
    PID:2992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1768
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FDWSS
      4⤵
      PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3884 -ip 3884
1⤵
PID:4696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2672
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1356
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XCLFG
    3⤵
    PID:5112
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:948
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\XCLFG
      4⤵
      System Location Discovery: System Language Discovery
      PID:2264

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2796
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1552
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\GWHYM
    3⤵
    PID:5340
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:396
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\GWHYM
      4⤵
      System Location Discovery: System Language Discovery
      PID:1440

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1300
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3260
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SZJNS
    3⤵
    - Adds Run key to start application
    PID:4444
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5200
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5200 -s 92
        5⤵
        Program crash
        
        PID:5244
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\SZJNS
      4⤵
      PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4736
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4908
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SZJNS
    3⤵
    PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2008 -ip 2008
1⤵
PID:2244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5348
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4176
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZWHOG
    3⤵
    - Adds Run key to start application
    PID:3292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2540
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3080
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YMCXG
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4576
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2348
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YMCXG
      4⤵
      System Location Discovery: System Language Discovery
      PID:1120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2484
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4728
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NBMGJ
    3⤵
    PID:1136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:820
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2944
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HRNVR
    3⤵
    PID:588
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5128
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\HRNVR
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5664
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5304
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\TSOUB
    3⤵
    - Adds Run key to start application
    PID:2068
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:880
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\TSOUB
      4⤵
      Adds Run key to start application
      PID:2132
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:3672
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\TSOUB
        5⤵
        
        PID:2984

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4872
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2112
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FGWIP
    3⤵
    PID:3592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1548
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3640
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WSFEJ
    3⤵
    - Adds Run key to start application
    PID:4032
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 16
        5⤵
        Program crash
        
        PID:1004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 24
        5⤵
        Program crash
        
        PID:3068
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\WSFEJ
      4⤵
      PID:396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3620
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5392
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WSFEJ
    3⤵
    PID:3100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5604
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4976
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\TASFB
    3⤵
    PID:5684

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5696
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3348
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IZZUM
    3⤵
    PID:3944
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:484
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\IZZUM
      4⤵
      System Location Discovery: System Language Discovery
      PID:2640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 5200 -ip 5200
1⤵
PID:1744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5840
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2776
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UURND
    3⤵
    PID:5600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3192
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4284
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SDNSN
    3⤵
    PID:820
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5264
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\SDNSN
      4⤵
      PID:1424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5332
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1940
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SDNSN
    3⤵
    PID:1388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4336
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2220
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XUBFB
    3⤵
    - System Location Discovery: System Language Discovery
    PID:748
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2280
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\XUBFB
      4⤵
      Adds Run key to start application
      PID:4020
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:5040
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\XUBFB
        5⤵
        
        PID:972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:388
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1344
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IBEUI
    3⤵
    PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5592
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2992
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SKCNO
    3⤵
    - Adds Run key to start application
    PID:3360
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1324
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\SKCNO
      4⤵
      PID:5696
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:3500
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\SKCNO
        5⤵
        
        PID:5376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2288
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3692
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\GXJUL
    3⤵
    - Adds Run key to start application
    PID:3620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5440
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4624
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XCDHO
    3⤵
    - Adds Run key to start application
    PID:4652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4208
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4628
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BXXGC
    3⤵
    - Adds Run key to start application
    PID:4892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5560
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4736
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\TNFPZ
    3⤵
    - Adds Run key to start application
    PID:2008
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3068
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\TNFPZ
      4⤵
      PID:4672
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:5672
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\TNFPZ
        5⤵
        
        PID:5944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4048 -ip 4048
1⤵
PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1048
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5752
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HQJIC
    3⤵
    PID:1584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5064
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3136
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HQJIC
    3⤵
    PID:1736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5272
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4192
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WPLZE
    3⤵
    - Adds Run key to start application
    PID:4704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 4048 -ip 4048
1⤵
PID:6036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3948
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2188
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VPDXJ
    3⤵
    - Adds Run key to start application
    PID:5312
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3060
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\VPDXJ
      4⤵
      Adds Run key to start application
      PID:1604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6096
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3844
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QBMUM
    3⤵
    - Adds Run key to start application
    PID:3968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6048
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1996
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UKHJC
    3⤵
    PID:2620
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4908
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4908 -s 92
        5⤵
        Program crash
        
        PID:3404
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\UKHJC
      4⤵
      Adds Run key to start application
      PID:388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2052
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3760
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\EKEWY
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5028
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5636
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\MEJML
    3⤵
    - Adds Run key to start application
    PID:3148
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5568
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5568 -s 92
        5⤵
        Program crash
        
        PID:2616
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\MEJML
      4⤵
      System Location Discovery: System Language Discovery
      PID:3900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4220
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4668
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\MEJML
    3⤵
    PID:5752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3392
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4592
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XAXUF
    3⤵
    PID:3068
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5152
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\XAXUF
      4⤵
      PID:4752
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:3564
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\XAXUF
        5⤵
        
        PID:3060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4808
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2584
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SMQGS
    3⤵
    - Adds Run key to start application
    PID:3276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6100
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2792
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZVLBH
    3⤵
    PID:2568
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6048
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\ZVLBH
      4⤵
      Adds Run key to start application
      PID:5956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5836
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4304
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\JUXIP
    3⤵
    PID:5712
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5304
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\JUXIP
      4⤵
      System Location Discovery: System Language Discovery
      PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5896
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4872
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\USIGE
    3⤵
    - Adds Run key to start application
    PID:2960
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5244
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5244 -s 92
        5⤵
        Program crash
        
        PID:3148
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\USIGE
      4⤵
      PID:2296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5516
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2436
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VVXLC
    3⤵
    - Adds Run key to start application
    PID:3844
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5536
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\VVXLC
      4⤵
      PID:2956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5832
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4308
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VVXLC
    3⤵
    PID:5368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3928
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5284
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SARWH
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3088
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4516
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KUWRG
    3⤵
    - Adds Run key to start application
    PID:5276
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5284
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\KUWRG
      4⤵
      Adds Run key to start application
      PID:5824
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\KUWRG
        5⤵
        
        PID:6148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1976
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1536
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KLAHQ
    3⤵
    - Adds Run key to start application
    PID:4692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3368
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5564
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LXRLR
    3⤵
    PID:5224
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4180
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\LXRLR
      4⤵
      PID:4348
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:6644
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\LXRLR
        5⤵
        
        PID:4896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5808
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5864
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NHPPG
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 4908 -ip 4908
1⤵
PID:3888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3700
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4920
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\MMGPD
    3⤵
    PID:5832
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4548
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\MMGPD
      4⤵
      PID:4920
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:6180
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6180 -s 92
        6⤵
        Program crash
        
        PID:6304
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\MMGPD
        5⤵
        
        PID:1228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2892
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5548
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LHLOM
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5568 -ip 5568
1⤵
PID:232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4632
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5680
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\GRZGZ
    3⤵
    - Adds Run key to start application
    PID:2244
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2756
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\GRZGZ
      4⤵
      PID:5664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:412
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2732
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BBBPH
    3⤵
    PID:3624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3724
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1720
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WEVFC
    3⤵
    PID:2348
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\WEVFC
      4⤵
      PID:6156
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:5588
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\WEVFC
        5⤵
        
        PID:7276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5092
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4568
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VMLZL
    3⤵
    PID:3744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5636
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4664
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\RJKYS
    3⤵
    PID:6212
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6428
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 92
        5⤵
        Program crash
        
        PID:6468
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\RJKYS
      4⤵
      PID:6460
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:5864
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 92
        6⤵
        Program crash
        
        PID:6272
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\RJKYS
        5⤵
        
        PID:656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5792
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5740
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AKQYN
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1828
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6112
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NKGVN
    3⤵
    PID:6488
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6604
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NKGVN
      4⤵
      PID:6636
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:2144
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 92
        6⤵
        Program crash
        
        PID:3192
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\NKGVN
        5⤵
        
        PID:4444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6036
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3672
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WXONZ
    3⤵
    PID:6704

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4696
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2020
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WXONZ
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5244 -ip 5244
1⤵
PID:3484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3572
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4592
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FFDJL
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5996
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5696
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\OLXKW
    3⤵
    - Adds Run key to start application
    PID:6940

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2764
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5828
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FCNOE
    3⤵
    PID:7040
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:232
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 92
        5⤵
        Program crash
        
        PID:6468
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FCNOE
      4⤵
      PID:4904
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:6376
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\FCNOE
        5⤵
        
        PID:6564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1492
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2560
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NHJRQ
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:6152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5936
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LOHJN
    3⤵
    PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5052
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2408
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BFBEW
    3⤵
    PID:1184
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:916
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\BFBEW
      4⤵
      PID:2132
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:6776
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\BFBEW
        5⤵
        
        PID:6008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4516
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2440
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WOKHY
    3⤵
    PID:2020

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5992
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5040
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YLTLA
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3496
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4884
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 92
        5⤵
        Program crash
        
        PID:1492
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YLTLA
      4⤵
      PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3520
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1016
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\EJVGY
    3⤵
    - Adds Run key to start application
    PID:2388
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6048
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6048 -s 92
        5⤵
        Program crash
        
        PID:3080
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\EJVGY
      4⤵
      PID:5224
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:7972
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7972 -s 92
        6⤵
        Program crash
        
        PID:5948
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\EJVGY
        5⤵
        
        PID:7224

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6076
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5500
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SGHDZ
    3⤵
    PID:4044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4848
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5104
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UHYHL
    3⤵
    - Adds Run key to start application
    PID:6168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2712
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4192
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KHHCJ
    3⤵
    PID:6124
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4516
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 92
        5⤵
        Program crash
        
        PID:4724
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\KHHCJ
      4⤵
      PID:4228
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
        5⤵
        
        PID:6264
    - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
        
        C:\Users\Admin\AppData\Roaming\wou\KHHCJ
        5⤵
        
        PID:5168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1784
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6176
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WVAKC
    3⤵
    PID:4016
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:7012
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\WVAKC
      4⤵
      PID:1436

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6240
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6284
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LZNSM
    3⤵
    - Adds Run key to start application
    PID:3032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6352
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6400
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZZILQ
    3⤵
    - Adds Run key to start application
    PID:5808
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4296
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\ZZILQ
      4⤵
      PID:1984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6428 -ip 6428
1⤵
PID:6444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6524
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6568
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PEDCR
    3⤵
    PID:5548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6784
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6868
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DQZLU
    3⤵
    PID:3064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6880
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6972
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FHRUR
    3⤵
    PID:6416
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2164
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FHRUR
      4⤵
      PID:988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7000
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7088
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BSEMK
    3⤵
    PID:5628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7080
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5844
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DBGIP
    3⤵
    PID:6544
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6560
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6560 -s 28
        5⤵
        Program crash
        
        PID:7000
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\DBGIP
      4⤵
      PID:3048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3888
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6620
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\REQPS
    3⤵
    PID:2104
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6668
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\REQPS
      4⤵
      PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4664
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4808
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KESLF
    3⤵
    PID:4744
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3040
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\KESLF
      4⤵
      PID:7096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 232 -ip 232
1⤵
PID:6444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2816
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6632
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PUSJY
    3⤵
    PID:6908

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6616
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2976
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CEVDK
    3⤵
    PID:4340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5080
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7152
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NKTCA
    3⤵
    PID:4644
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6700
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NKTCA
      4⤵
      PID:7228

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4088
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1868
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YEJZU
    3⤵
    PID:4992
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:7216
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7216 -s 92
        5⤵
        Program crash
        
        PID:7448
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YEJZU
      4⤵
      PID:7356

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3636
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3704
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZTKJO
    3⤵
    PID:4336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6164
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3844
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LLTIK
    3⤵
    PID:6092
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:7580
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 92
        5⤵
        Program crash
        
        PID:7648
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\LLTIK
      4⤵
      PID:7628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3136
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3300
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UOJXI
    3⤵
    PID:7172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4884 -ip 4884
1⤵
PID:3712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6048 -ip 6048
1⤵
PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:920
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3852
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UOJXI
    3⤵
    PID:7252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4916
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3148
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XMSKE
    3⤵
    PID:7528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4084
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1772
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XMSKE
    3⤵
    PID:7552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4516 -ip 4516
1⤵
PID:3856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4700
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3832
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\MJEOB
    3⤵
    PID:7760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5104
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3084
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\MJEOB
    3⤵
    PID:7772

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1500
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1652
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FZJVF
    3⤵
    PID:7708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6180 -ip 6180
1⤵
PID:1608

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3540
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6356
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FJWCS
    3⤵
    PID:7956

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6244
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6588
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SYWUS
    3⤵
    PID:7896
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:8116
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\SYWUS
      4⤵
      PID:8168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6388
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6916
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CPIFC
    3⤵
    PID:7272
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3776
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\CPIFC
      4⤵
      PID:1244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1760
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3260
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PIEQU
    3⤵
    PID:3852
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6324
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 92
        5⤵
        Program crash
        
        PID:4604
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\PIEQU
      4⤵
      PID:7692

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1148
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5220
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\GARSE
    3⤵
    PID:236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6840
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5028
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LOHWC
    3⤵
    PID:1248

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2732
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:416
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\TPOIQ
    3⤵
    PID:5596
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6468
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\TPOIQ
      4⤵
      PID:2484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6560 -ip 6560
1⤵
PID:4644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7016
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3516
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AWOTP
    3⤵
    PID:2116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7004
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4776
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AWOTP
    3⤵
    PID:3596

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2668
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:2976
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7412
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DMRLH
    3⤵
    PID:7952
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1628
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 92
        5⤵
        Program crash
        
        PID:3444
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\DMRLH
      4⤵
      PID:6196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6368
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6828
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\KWIPN
    3⤵
    PID:5620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2848
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7496
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NVAMQ
    3⤵
    PID:5900
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5340
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NVAMQ
      4⤵
      PID:6864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3092
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7720
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AORSJ
    3⤵
    PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7216 -ip 7216
1⤵
PID:7304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7348
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7668
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AORSJ
    3⤵
    PID:8144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7580 -ip 7580
1⤵
PID:7600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7792
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7868
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PUQOC
    3⤵
    PID:4612
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2416
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\PUQOC
      4⤵
      PID:5624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7944
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:8068
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VXELV
    3⤵
    PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:8020
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:8156
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CVSJD
    3⤵
    PID:4752
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:7452
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\CVSJD
      4⤵
      PID:5656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2320
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7324
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NJOTB
    3⤵
    PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7196
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2824
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UINZE
    3⤵
    PID:5356
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2292
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\UINZE
      4⤵
      PID:960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7448
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3396
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UHGIB
    3⤵
    PID:7076

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3564
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7768
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PIZAL
    3⤵
    PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6324 -ip 6324
1⤵
PID:6648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4916
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5328
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\UHGIB
    3⤵
    PID:7416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3452
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7056
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FMMIW
    3⤵
    PID:1912
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:7872
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7872 -s 28
        5⤵
        Program crash
        
        PID:1364
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FMMIW
      4⤵
      PID:5880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5864 -ip 5864
1⤵
PID:2820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1672
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6556
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HZOOK
    3⤵
    PID:6380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2800
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1820
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CFCPX
    3⤵
    PID:6876
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6348
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\CFCPX
      4⤵
      PID:2664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5148
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4332
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NVMWP
    3⤵
    PID:5928
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6516
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NVMWP
      4⤵
      PID:1432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5508
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4624
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\WJFBN
    3⤵
    PID:5200
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:3864
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\WJFBN
      4⤵
      PID:6820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 1628 -ip 1628
1⤵
PID:4820

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6840
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5652
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\JGCWA
    3⤵
    PID:412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2792
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3824
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IOUYA
    3⤵
    PID:7152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6432
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6648
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HYHGK
    3⤵
    PID:5432
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4084
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\HYHGK
      4⤵
      PID:5572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:380
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6712
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AQKZT
    3⤵
    PID:2212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7112
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6616
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LNDYF
    3⤵
    PID:6128
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6552
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\LNDYF
      4⤵
      PID:5028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5380
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5012
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\RUQCJ
    3⤵
    PID:5696
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6488
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\RUQCJ
      4⤵
      PID:6276

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7332
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1676
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BGRFW
    3⤵
    PID:7504

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7880
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7380
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\SXUHF
    3⤵
    PID:2808
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2672
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\SXUHF
      4⤵
      PID:6860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 7872 -ip 7872
1⤵
PID:7384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7864
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4880
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BBNMF
    3⤵
    PID:2620

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5828
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5804
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PZBLM
    3⤵
    PID:6736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5840
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3844
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VIGMX
    3⤵
    PID:3192
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6732
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6732 -s 92
        5⤵
        Program crash
        
        PID:6808
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\VIGMX
      4⤵
      PID:4912

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:8016
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2268
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\XUHUN
    3⤵
    PID:2792
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2988
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\XUHUN
      4⤵
      PID:5016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:8108
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:676
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\PZBLM
    3⤵
    PID:4876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2144 -ip 2144
1⤵
PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:2812
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6988
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YTAND
    3⤵
    PID:6252
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6312
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YTAND
      4⤵
      PID:7884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4544
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7616
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ESCTE
    3⤵
    PID:1680

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7444
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2776
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VBNMJ
    3⤵
    PID:7488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7904
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4856
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\FPBWQ
    3⤵
    PID:244
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:4280
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\FPBWQ
      4⤵
      PID:6832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4952
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5564
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QHHRP
    3⤵
    PID:4852
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2276
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\QHHRP
      4⤵
      PID:6408

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3512
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6744
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DSNHW
    3⤵
    PID:1900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7536
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4160
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VJLYQ
    3⤵
    PID:6600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:416
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2848
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DTECO
    3⤵
    PID:4776
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2288
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\DTECO
      4⤵
      PID:7160

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6216
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6968
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\CDUGM
    3⤵
    PID:2352
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2348
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\CDUGM
      4⤵
      PID:6400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6676
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5100
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\RRYMP
    3⤵
    PID:7036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 6732 -ip 6732
1⤵
PID:7868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6108
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4232
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\YLGSO
    3⤵
    PID:1656
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:640
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\YLGSO
      4⤵
      PID:5584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7016
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2200
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BYGAI
    3⤵
    PID:4664
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:5268
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\BYGAI
      4⤵
      PID:5128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3816
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:4748
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\ZFNBA
    3⤵
    PID:7024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4540
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6064
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HDTUM
    3⤵
    PID:2648

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1948
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:8100
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IVZNP
    3⤵
    PID:452
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:8
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\IVZNP
      4⤵
      PID:2960

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1104
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5680
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HDTUM
    3⤵
    PID:7284

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7676
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7120
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\EKHTO
    3⤵
    PID:7484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7964
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:564
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\NYCJF
    3⤵
    PID:6496
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1744
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\NYCJF
      4⤵
      PID:4888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7140
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7440
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\DGRZX
    3⤵
    PID:2616
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2200
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\DGRZX
      4⤵
      PID:6972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7240
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6840
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AYWWJ
    3⤵
    PID:7340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7444
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5252
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\HQKFR
    3⤵
    PID:4568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7268
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:8164
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AYWWJ
    3⤵
    PID:4808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4952
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7312
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AEVTL
    3⤵
    PID:7940
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:8136
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\AEVTL
      4⤵
      PID:6500

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:1768
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1344
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\LDBFE
    3⤵
    PID:1652

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7468
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1864
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\AJCEF
    3⤵
    PID:8060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4332
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6164
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\BEWHX
    3⤵
    PID:6136
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:2552
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\BEWHX
      4⤵
      PID:4256

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3704
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3284
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\OEYZG
    3⤵
    PID:3892

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6060
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:7788
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\VHEQQ
    3⤵
    PID:7928
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:6292
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      C:\Users\Admin\AppData\Roaming\wou\VHEQQ
      4⤵
      PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7644
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:3324
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\IGTHR
    3⤵
    PID:6656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:5528
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:1556
- - C:\Users\Admin\AppData\Roaming\wou\odm.exe
    C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\QTZXP
    3⤵
    PID:7492

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7436
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:8024
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:5300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7876
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:3876
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:6304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:4960
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:2448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6980
- C:\Users\Admin\AppData\Roaming\wou\odm.exe
  C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
  2⤵
  PID:332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 7972 -ip 7972
1⤵
PID:4236

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:8072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:7184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\wou\odm.exe C:\Users\Admin\AppData\Roaming\wou\kja-pex
1⤵
PID:6792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\RegSvcs.exe.log

Filesize
774B

MD5
fd61b64fd2d3ee1cff51b55ab65bdd7d

SHA1
9c0cc4248004e7da57ac99f12daa6f461d41d6c1

SHA256
8d7b77655763d9dd3be5b08e74fcaf2a8266ca400ead7d84c90ef145e76bd9aa

SHA512
e7e472ed8cc5488d4aa4114f26cef3d6360719b096b420022647ee9b0ff836d0deefe0ab2c44950dca4cd553469e28a2cb7b5907b5253b6b993b0317600a566a

Download Submit
C:\Users\Admin\AppData\Local\Temp\holderwb.txt

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\wou\QRPML

Filesize
183KB

MD5
2fc79199952da8ef486b513a911b6fd4

SHA1
c840b0684f2ebdbbf603fabf4a32e629453c48d0

SHA256
a4ff9e68389eceb7e9fe4a6c428d156e9b5536e1dc1f83f05e3c69ce312f465c

SHA512
7b4fd2a5fb42fbfd4e4f5b4a19b82aa4761bf40192eef83321a034cd531e8a7309e5c68628e594435ae0869579bc251d8eef168c833dc8dbbf75e68d41ec0f4d

Download Submit
C:\Users\Admin\AppData\Roaming\wou\QRPML

Filesize
91KB

MD5
9375872d82fbfe00eb4f6e608aa170d8

SHA1
b6d6f7059c025075141293cc0c1f80c1063ef75b

SHA256
a1b44347af8b2b2bf0409bb96e99f012035dc494ef44db409dbcd2bb726ff2e9

SHA512
f05e7f8c5d4edc6c41c0a2e4c63492a8578a4ae44e093396214fe422b90bd6e6d5fc98e1d8c4ee2253845a8b1a0bf202cd27450f641a8261d7f660b26162b863

Download Submit
C:\Users\Admin\AppData\Roaming\wou\odm.exe

Filesize
732KB

MD5
71d8f6d5dc35517275bc38ebcc815f9f

SHA1
cae4e8c730de5a01d30aabeb3e5cb2136090ed8d

SHA256
fb73a819b37523126c7708a1d06f3b8825fa60c926154ab2d511ba668f49dc4b

SHA512
4826f45000ea50d9044e3ef11e83426281fbd5f3f5a25f9786c2e487b4cf26b04f6f900ca6e70440644c9d75f700a4c908ab6f398f59c65ee1bff85dfef4ce59

Download Submit
C:\Users\Admin\AppData\Roaming\wou\rid.ico

Filesize
1.2MB

MD5
a5f2dcee6a2a6047aa8fdde1ae2ce290

SHA1
7a082661c9a3431cd89ed4d9959178d60b9570f7

SHA256
7da78e767ff859970c8dae593b62f1366c2c651500eb280f0077a2245a9a8625

SHA512
e001300fc56f9bc8e9d61cb904ea6dec5ca447729015c9ff3dccc021f319fcce57ebaabb196a56f80d249dfbb88b4a0a273858cf14c7b9a93c10c9c8bc243d0a

Download Submit
C:\Users\Admin\AppData\Roaming\wou\spd

Filesize
4B

MD5
098f6bcd4621d373cade4e832627b4f6

SHA1
a94a8fe5ccb19ba61c4c0873d391e987982fbbd3

SHA256
9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08

SHA512
ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff

Download Submit
C:\Users\Admin\AppData\Roaming\wou\spd

Filesize
8B

MD5
05a671c66aefea124cc08b76ea6d30bb

SHA1
51abb9636078defbf888d8457a7c76f85c8f114c

SHA256
37268335dd6931045bdcdf92623ff819a64244b53d0e746d438797349d4da578

SHA512
125d6d03b32c84d492747f79cf0bf6e179d287f341384eb5d6d3197525ad6be8e6df0116032935698f99a09e265073d1d6c32c274591bf1d0a20ad67cba921bc

Download Submit
memory/656-234-0x0000000000D20000-0x0000000000DEC000-memory.dmp

Filesize
816KB

Download
memory/656-235-0x0000000000D20000-0x0000000000DEC000-memory.dmp

Filesize
816KB

Download
memory/772-287-0x0000000000D30000-0x0000000000DFC000-memory.dmp

Filesize
816KB

Download
memory/2008-283-0x0000000000E00000-0x0000000000ECC000-memory.dmp

Filesize
816KB

Download
memory/2008-281-0x0000000000E00000-0x0000000000ECC000-memory.dmp

Filesize
816KB

Download
memory/2076-131-0x0000000000D00000-0x0000000000DCC000-memory.dmp

Filesize
816KB

Download
memory/2076-132-0x0000000000D00000-0x0000000000DCC000-memory.dmp

Filesize
816KB

Download
memory/2200-205-0x0000000000630000-0x00000000006FC000-memory.dmp

Filesize
816KB

Download
memory/2200-204-0x0000000000630000-0x00000000006FC000-memory.dmp

Filesize
816KB

Download
memory/2396-162-0x0000000000F20000-0x0000000000FEC000-memory.dmp

Filesize
816KB

Download
memory/2396-163-0x0000000000F20000-0x0000000000FEC000-memory.dmp

Filesize
816KB

Download
memory/2432-112-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2432-118-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2432-111-0x0000000000400000-0x0000000000458000-memory.dmp

Filesize
352KB

Download
memory/2556-105-0x00000000005A0000-0x000000000066C000-memory.dmp

Filesize
816KB

Download
memory/2556-104-0x00000000005A0000-0x000000000066C000-memory.dmp

Filesize
816KB

Download
memory/2656-110-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2656-109-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2656-108-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2708-241-0x0000000001330000-0x00000000013FC000-memory.dmp

Filesize
816KB

Download
memory/2708-240-0x0000000001330000-0x00000000013FC000-memory.dmp

Filesize
816KB

Download
memory/2980-152-0x0000000000500000-0x00000000005CC000-memory.dmp

Filesize
816KB

Download
memory/2980-153-0x0000000000500000-0x00000000005CC000-memory.dmp

Filesize
816KB

Download
memory/3252-275-0x0000000000B10000-0x0000000000BDC000-memory.dmp

Filesize
816KB

Download
memory/3252-276-0x0000000000B10000-0x0000000000BDC000-memory.dmp

Filesize
816KB

Download
memory/3256-215-0x0000000000960000-0x0000000000A2C000-memory.dmp

Filesize
816KB

Download
memory/3256-214-0x0000000000960000-0x0000000000A2C000-memory.dmp

Filesize
816KB

Download
memory/4600-179-0x0000000001100000-0x00000000011CC000-memory.dmp

Filesize
816KB

Download
memory/4600-178-0x0000000001100000-0x00000000011CC000-memory.dmp

Filesize
816KB

Download
memory/4948-270-0x0000000000780000-0x000000000084C000-memory.dmp

Filesize
816KB

Download
memory/4948-271-0x0000000000780000-0x000000000084C000-memory.dmp

Filesize
816KB

Download
memory/5020-263-0x0000000001300000-0x00000000013CC000-memory.dmp

Filesize
816KB

Download
memory/5020-264-0x0000000001300000-0x00000000013CC000-memory.dmp

Filesize
816KB

Download
memory/5024-189-0x0000000000410000-0x00000000004DC000-memory.dmp

Filesize
816KB

Download
memory/5024-188-0x0000000000410000-0x00000000004DC000-memory.dmp

Filesize
816KB

Download
memory/5216-223-0x0000000000900000-0x00000000009CC000-memory.dmp

Filesize
816KB

Download
memory/5216-222-0x0000000000900000-0x00000000009CC000-memory.dmp

Filesize
816KB

Download
memory/5616-258-0x0000000000800000-0x00000000008CC000-memory.dmp

Filesize
816KB

Download
memory/5616-259-0x0000000000800000-0x00000000008CC000-memory.dmp

Filesize
816KB

Download
memory/5728-143-0x0000000001200000-0x00000000012CC000-memory.dmp

Filesize
816KB

Download
memory/5728-142-0x0000000001200000-0x00000000012CC000-memory.dmp

Filesize
816KB

Download
memory/5812-102-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/5852-229-0x0000000001180000-0x000000000124C000-memory.dmp

Filesize
816KB

Download
memory/5852-228-0x0000000001180000-0x000000000124C000-memory.dmp

Filesize
816KB

Download