gh0strat | ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

Analysis

max time kernel
151s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09-05-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

589.exe
Size

216KB
MD5

a824640862ea34979abb4d80f2ee07b1
SHA1

529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed
SHA256

ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21
SHA512

99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/720-130-0x0000000010000000-0x0000000010033000-memory.dmp	family_gh0strat
behavioral2/memory/660-136-0x0000000010000000-0x0000000010033000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 64 IoCs

Processes:

cugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.exe

pid	Process
660	cugcue.exe
4688	cugcue.exe
4408	cugcue.exe
4568	cugcue.exe
1060	cugcue.exe
3488	cugcue.exe
4832	cugcue.exe
532	cugcue.exe
1788	cugcue.exe
2468	cugcue.exe
5116	cugcue.exe
2740	cugcue.exe
3984	cugcue.exe
2028	cugcue.exe
2488	cugcue.exe
3092	cugcue.exe
4060	cugcue.exe
4224	cugcue.exe
3356	cugcue.exe
4624	cugcue.exe
2176	cugcue.exe
4708	cugcue.exe
4352	cugcue.exe
3208	cugcue.exe
4412	cugcue.exe
3172	cugcue.exe
4072	cugcue.exe
1672	cugcue.exe
2084	cugcue.exe
4456	cugcue.exe
2244	cugcue.exe
1104	cugcue.exe
4576	cugcue.exe
4824	cugcue.exe
3408	cugcue.exe
4000	cugcue.exe
4016	cugcue.exe
4552	cugcue.exe
4028	cugcue.exe
3156	cugcue.exe
2216	cugcue.exe
4668	cugcue.exe
2100	cugcue.exe
3988	cugcue.exe
444	cugcue.exe
2916	cugcue.exe
1200	cugcue.exe
1844	cugcue.exe
4664	cugcue.exe
4208	cugcue.exe
2176	cugcue.exe
5036	cugcue.exe
3392	cugcue.exe
3968	cugcue.exe
3292	cugcue.exe
1920	cugcue.exe
3988	cugcue.exe
1980	cugcue.exe
1428	cugcue.exe
1596	cugcue.exe
3080	cugcue.exe
4080	cugcue.exe
3220	cugcue.exe
544	cugcue.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

589.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	589.exe

Drops file in Windows directory 2 IoCs

Processes:

589.exe

description	ioc	Process
File created	C:\Windows\cugcue.exe	589.exe
File opened for modification	C:\Windows\cugcue.exe	589.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	Process	procid_target
3956	660	WerFault.exe	83
3804	4568	WerFault.exe	94
4936	4832	WerFault.exe	99
3048	2468	WerFault.exe	106
3140	3984	WerFault.exe	111
3132	3092	WerFault.exe	116
940	3356	WerFault.exe	121
4744	4708	WerFault.exe	126
3088	4412	WerFault.exe	131
4560	1672	WerFault.exe	136
1788	2244	WerFault.exe	142
3412	4824	WerFault.exe	147
4888	4016	WerFault.exe	153
3208	3156	WerFault.exe	158
4860	2100	WerFault.exe	164
5116	2916	WerFault.exe	170
4140	4664	WerFault.exe	177
1404	5036	WerFault.exe	183
3316	3292	WerFault.exe	189
2432	1980	WerFault.exe	194
3412	3080	WerFault.exe	199
3556	544	WerFault.exe	204
4076	4548	WerFault.exe	209
2176	4964	WerFault.exe	214
3604	4244	WerFault.exe	219
316	3608	WerFault.exe	224
3904	3980	WerFault.exe	229
4520	1992	WerFault.exe	234
1784	1268	WerFault.exe	239
4796	3408	WerFault.exe	244
4556	2916	WerFault.exe	249
1364	1340	WerFault.exe	254
4964	3732	WerFault.exe	259
2096	2940	WerFault.exe	264
4204	1884	WerFault.exe	269
4728	4032	WerFault.exe	274
3292	4996	WerFault.exe	279
3048	3268	WerFault.exe	284
4152	1876	WerFault.exe	290
1844	2812	WerFault.exe	295
1188	1408	WerFault.exe	300
4476	1592	WerFault.exe	305
2748	3924	WerFault.exe	310
2128	4240	WerFault.exe	315
1708	4660	WerFault.exe	320
4156	1884	WerFault.exe	325
400	1680	WerFault.exe	330
2740	1604	WerFault.exe	335
312	3808	WerFault.exe	340
1496	508	WerFault.exe	345
5076	3452	WerFault.exe	350
4820	4556	WerFault.exe	355
3972	4888	WerFault.exe	360
3128	2124	WerFault.exe	365
4904	308	WerFault.exe	370
1140	316	WerFault.exe	375
3516	1548	WerFault.exe	380
4780	3488	WerFault.exe	385
2608	3804	WerFault.exe	390
1392	1604	WerFault.exe	395
3408	728	WerFault.exe	400
4656	3956	WerFault.exe	405
612	4652	WerFault.exe	410
2568	4516	WerFault.exe	415

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cugcue.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cugcue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	cugcue.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

cugcue.exe

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	cugcue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cugcue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	cugcue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	cugcue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	cugcue.exe

Modifies registry class 1 IoCs

Processes:

589.exe

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	589.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cugcue.exe

pid	Process
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cugcue.exe589.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.exe

description	pid	Process	procid_target
PID 660 wrote to memory of 4688	660	cugcue.exe	84
PID 660 wrote to memory of 4688	660	cugcue.exe	84
PID 660 wrote to memory of 4688	660	cugcue.exe	84
PID 660 wrote to memory of 4408	660	cugcue.exe	85
PID 660 wrote to memory of 4408	660	cugcue.exe	85
PID 660 wrote to memory of 4408	660	cugcue.exe	85
PID 720 wrote to memory of 1924	720	589.exe	88
PID 720 wrote to memory of 1924	720	589.exe	88
PID 720 wrote to memory of 1924	720	589.exe	88
PID 4568 wrote to memory of 1060	4568	cugcue.exe	95
PID 4568 wrote to memory of 1060	4568	cugcue.exe	95
PID 4568 wrote to memory of 1060	4568	cugcue.exe	95
PID 4568 wrote to memory of 3488	4568	cugcue.exe	96
PID 4568 wrote to memory of 3488	4568	cugcue.exe	96
PID 4568 wrote to memory of 3488	4568	cugcue.exe	96
PID 4832 wrote to memory of 532	4832	cugcue.exe	102
PID 4832 wrote to memory of 532	4832	cugcue.exe	102
PID 4832 wrote to memory of 532	4832	cugcue.exe	102
PID 4832 wrote to memory of 1788	4832	cugcue.exe	103
PID 4832 wrote to memory of 1788	4832	cugcue.exe	103
PID 4832 wrote to memory of 1788	4832	cugcue.exe	103
PID 2468 wrote to memory of 5116	2468	cugcue.exe	107
PID 2468 wrote to memory of 5116	2468	cugcue.exe	107
PID 2468 wrote to memory of 5116	2468	cugcue.exe	107
PID 2468 wrote to memory of 2740	2468	cugcue.exe	108
PID 2468 wrote to memory of 2740	2468	cugcue.exe	108
PID 2468 wrote to memory of 2740	2468	cugcue.exe	108
PID 3984 wrote to memory of 2028	3984	cugcue.exe	112
PID 3984 wrote to memory of 2028	3984	cugcue.exe	112
PID 3984 wrote to memory of 2028	3984	cugcue.exe	112
PID 3984 wrote to memory of 2488	3984	cugcue.exe	113
PID 3984 wrote to memory of 2488	3984	cugcue.exe	113
PID 3984 wrote to memory of 2488	3984	cugcue.exe	113
PID 3092 wrote to memory of 4060	3092	cugcue.exe	117
PID 3092 wrote to memory of 4060	3092	cugcue.exe	117
PID 3092 wrote to memory of 4060	3092	cugcue.exe	117
PID 3092 wrote to memory of 4224	3092	cugcue.exe	118
PID 3092 wrote to memory of 4224	3092	cugcue.exe	118
PID 3092 wrote to memory of 4224	3092	cugcue.exe	118
PID 3356 wrote to memory of 4624	3356	cugcue.exe	122
PID 3356 wrote to memory of 4624	3356	cugcue.exe	122
PID 3356 wrote to memory of 4624	3356	cugcue.exe	122
PID 3356 wrote to memory of 2176	3356	cugcue.exe	123
PID 3356 wrote to memory of 2176	3356	cugcue.exe	123
PID 3356 wrote to memory of 2176	3356	cugcue.exe	123
PID 4708 wrote to memory of 4352	4708	cugcue.exe	127
PID 4708 wrote to memory of 4352	4708	cugcue.exe	127
PID 4708 wrote to memory of 4352	4708	cugcue.exe	127
PID 4708 wrote to memory of 3208	4708	cugcue.exe	128
PID 4708 wrote to memory of 3208	4708	cugcue.exe	128
PID 4708 wrote to memory of 3208	4708	cugcue.exe	128
PID 4412 wrote to memory of 3172	4412	cugcue.exe	132
PID 4412 wrote to memory of 3172	4412	cugcue.exe	132
PID 4412 wrote to memory of 3172	4412	cugcue.exe	132
PID 4412 wrote to memory of 4072	4412	cugcue.exe	133
PID 4412 wrote to memory of 4072	4412	cugcue.exe	133
PID 4412 wrote to memory of 4072	4412	cugcue.exe	133
PID 1672 wrote to memory of 2084	1672	cugcue.exe	137
PID 1672 wrote to memory of 2084	1672	cugcue.exe	137
PID 1672 wrote to memory of 2084	1672	cugcue.exe	137
PID 1672 wrote to memory of 4456	1672	cugcue.exe	139
PID 1672 wrote to memory of 4456	1672	cugcue.exe	139
PID 1672 wrote to memory of 4456	1672	cugcue.exe	139
PID 2244 wrote to memory of 1104	2244	cugcue.exe	143

C:\Users\Admin\AppData\Local\Temp\589.exe
"C:\Users\Admin\AppData\Local\Temp\589.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:720
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\6726.vbs"
  2⤵
  PID:1924

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 588
  2⤵
  - Program crash
  PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 660 -ip 660
1⤵
PID:1544

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1060
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 552
  2⤵
  - Program crash
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4568 -ip 4568
1⤵
PID:1220

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:532
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1788
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 620
  2⤵
  - Program crash
  PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4832 -ip 4832
1⤵
PID:1860

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:5116
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2740
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 544
  2⤵
  - Program crash
  PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2468 -ip 2468
1⤵
PID:3760

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2028
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 620
  2⤵
  - Program crash
  PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3984 -ip 3984
1⤵
PID:4052

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4060
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 552
  2⤵
  - Program crash
  PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3092 -ip 3092
1⤵
PID:4964

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4624
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 612
  2⤵
  - Program crash
  PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3356 -ip 3356
1⤵
PID:2068

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3208
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 552
  2⤵
  - Program crash
  PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4708 -ip 4708
1⤵
PID:1632

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3172
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4072
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 552
  2⤵
  - Program crash
  PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4412 -ip 4412
1⤵
PID:8

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2084
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4456
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 552
  2⤵
  - Program crash
  PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1672 -ip 1672
1⤵
PID:4520

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1104
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 620
  2⤵
  - Program crash
  PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2244 -ip 2244
1⤵
PID:3768

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:4824
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3408
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4000
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 552
  2⤵
  - Program crash
  PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4824 -ip 4824
1⤵
PID:2160

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:4016
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4552
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 620
  2⤵
  - Program crash
  PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4016 -ip 4016
1⤵
PID:5028

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:3156
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2216
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 612
  2⤵
  - Program crash
  PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3156 -ip 3156
1⤵
PID:4204

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:2100
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 620
  2⤵
  - Program crash
  PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2100 -ip 2100
1⤵
PID:4544

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:2916
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1200
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 552
  2⤵
  - Program crash
  PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2916 -ip 2916
1⤵
PID:4948

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:4664
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4208
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 608
  2⤵
  - Program crash
  PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4664 -ip 4664
1⤵
PID:2336

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:5036
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3392
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3968
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 640
  2⤵
  - Program crash
  PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5036 -ip 5036
1⤵
PID:2868

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:3292
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1920
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3988
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 620
  2⤵
  - Program crash
  PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3292 -ip 3292
1⤵
PID:1972

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:1980
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 552
  2⤵
  - Program crash
  PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1980 -ip 1980
1⤵
PID:4192

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:3080
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:4080
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  - Executes dropped EXE
  PID:3220
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 552
  2⤵
  - Program crash
  PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3080 -ip 3080
1⤵
PID:2284

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:544
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3744
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1844
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 620
  2⤵
  - Program crash
  PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 544 -ip 544
1⤵
PID:5068

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4548
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3044
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 552
  2⤵
  - Program crash
  PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4548 -ip 4548
1⤵
PID:2068

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4964
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1888
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 632
  2⤵
  - Program crash
  PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4964 -ip 4964
1⤵
PID:4732

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4244
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4748
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 552
  2⤵
  - Program crash
  PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4244 -ip 4244
1⤵
PID:2216

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3608
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4248
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 620
  2⤵
  - Program crash
  PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3608 -ip 3608
1⤵
PID:1336

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3980
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4348
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3488
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 592
  2⤵
  - Program crash
  PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3980 -ip 3980
1⤵
PID:3984

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1992
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:660
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:768
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 552
  2⤵
  - Program crash
  PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1992 -ip 1992
1⤵
PID:3248

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1268
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1876
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 552
  2⤵
  - Program crash
  PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1268 -ip 1268
1⤵
PID:2372

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3408
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4124
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2812
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 620
  2⤵
  - Program crash
  PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3408 -ip 3408
1⤵
PID:3080

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2916
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4256
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4004
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 620
  2⤵
  - Program crash
  PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2916 -ip 2916
1⤵
PID:3864

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1340
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4476
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 612
  2⤵
  - Program crash
  PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1340 -ip 1340
1⤵
PID:3044

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3732
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1452
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2176
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 204
  2⤵
  - Program crash
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3732 -ip 3732
1⤵
PID:2124

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2940
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2052
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 552
  2⤵
  - Program crash
  PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2940 -ip 2940
1⤵
PID:720

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1884
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1404
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3960
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 588
  2⤵
  - Program crash
  PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1884 -ip 1884
1⤵
PID:4568

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4032
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1680
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:444
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 588
  2⤵
  - Program crash
  PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4032 -ip 4032
1⤵
PID:1548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4996
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1604
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4412
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 552
  2⤵
  - Program crash
  PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4996 -ip 4996
1⤵
PID:3988

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3268
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3796
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1820
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 552
  2⤵
  - Program crash
  PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3268 -ip 3268
1⤵
PID:1052

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1876
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5112
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4832
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 620
  2⤵
  - Program crash
  PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1876 -ip 1876
1⤵
PID:2024

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2812
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3636
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3556
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 556
  2⤵
  - Program crash
  PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2812 -ip 2812
1⤵
PID:3452

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1408
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2468
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 620
  2⤵
  - Program crash
  PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1408 -ip 1408
1⤵
PID:5028

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1592
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3560
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4676
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 556
  2⤵
  - Program crash
  PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1592 -ip 1592
1⤵
PID:2144

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3924
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3008
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2540
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 552
  2⤵
  - Program crash
  PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3924 -ip 3924
1⤵
PID:4856

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4240
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3188
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4668
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 552
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4240 -ip 4240
1⤵
PID:4748

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4660
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5084
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4560
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 588
  2⤵
  - Program crash
  PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4660 -ip 4660
1⤵
PID:1672

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1884
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:8
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 620
  2⤵
  - Program crash
  PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1884 -ip 1884
1⤵
PID:3572

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1680
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4972
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3316
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 552
  2⤵
  - Program crash
  PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1680 -ip 1680
1⤵
PID:2884

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1604
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1104
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2244
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 556
  2⤵
  - Program crash
  PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1604 -ip 1604
1⤵
PID:1788

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3808
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3012
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1460
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 620
  2⤵
  - Program crash
  PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3808 -ip 3808
1⤵
PID:1200

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:508
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3088
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1276
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 620
  2⤵
  - Program crash
  PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 508 -ip 508
1⤵
PID:800

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3452
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2864
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4124
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 552
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3452 -ip 3452
1⤵
PID:3556

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4556
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1520
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1904
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 620
  2⤵
  - Program crash
  PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4556 -ip 4556
1⤵
PID:4084

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4888
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1364
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 556
  2⤵
  - Program crash
  PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4888 -ip 4888
1⤵
PID:5100

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2124
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4112
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2504
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 552
  2⤵
  - Program crash
  PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 2124 -ip 2124
1⤵
PID:4440

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:308
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1236
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2140
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 552
  2⤵
  - Program crash
  PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 308 -ip 308
1⤵
PID:2096

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:316
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1672
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5036
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 552
  2⤵
  - Program crash
  PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 316 -ip 316
1⤵
PID:1968

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1548
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1972
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4860
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 620
  2⤵
  - Program crash
  PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 1548 -ip 1548
1⤵
PID:4456

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3488
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4544
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2020
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 620
  2⤵
  - Program crash
  PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3488 -ip 3488
1⤵
PID:4760

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3804
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1596
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2284
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 544
  2⤵
  - Program crash
  PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3804 -ip 3804
1⤵
PID:2448

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1604
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3204
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1100
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 620
  2⤵
  - Program crash
  PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 1604 -ip 1604
1⤵
PID:4824

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:728
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4196
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 600
  2⤵
  - Program crash
  PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 728 -ip 728
1⤵
PID:5096

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3956
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2784
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 552
  2⤵
  - Program crash
  PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3956 -ip 3956
1⤵
PID:3252

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4652
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2816
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3660
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 552
  2⤵
  - Program crash
  PID:612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 4652 -ip 4652
1⤵
PID:3308

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4516
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3004
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2400
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 552
  2⤵
  - Program crash
  PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4516 -ip 4516
1⤵
PID:2288

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3560
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5064
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 556
  2⤵
  PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3560 -ip 3560
1⤵
PID:4548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3924
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2788
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1436
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 552
  2⤵
  PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3924 -ip 3924
1⤵
PID:3492

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1280
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4904
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4092
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 560
  2⤵
  PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1280 -ip 1280
1⤵
PID:3548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3664
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4560
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1672
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 552
  2⤵
  PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3664 -ip 3664
1⤵
PID:316

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4036
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3056
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 592
  2⤵
  PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4036 -ip 4036
1⤵
PID:3572

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4024
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5032
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4780
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 616
  2⤵
  PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4024 -ip 4024
1⤵
PID:1060

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1244
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1980
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2608
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 552
  2⤵
  PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1244 -ip 1244
1⤵
PID:4072

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4152
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2304
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1392
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 552
  2⤵
  PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4152 -ip 4152
1⤵
PID:4080

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3180
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1920
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3408
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 556
  2⤵
  PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3180 -ip 3180
1⤵
PID:660

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3132
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1676
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1928
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 620
  2⤵
  PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3132 -ip 3132
1⤵
PID:2260

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1844
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1624
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 620
  2⤵
  PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1844 -ip 1844
1⤵
PID:3044

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3480
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1724
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 552
  2⤵
  PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3480 -ip 3480
1⤵
PID:1340

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:364
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2400
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2336
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 552
  2⤵
  PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 364 -ip 364
1⤵
PID:2536

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1856
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3772
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:2216
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 612
  2⤵
  PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1856 -ip 1856
1⤵
PID:736

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4968
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4224
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1144
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 552
  2⤵
  PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4968 -ip 4968
1⤵
PID:720

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2440
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3820
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:320
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 556
  2⤵
  PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 2440 -ip 2440
1⤵
PID:1708

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1280
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4604
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4588
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 588
  2⤵
  PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1280 -ip 1280
1⤵
PID:4296

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4560
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4712
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1056
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 552
  2⤵
  PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4560 -ip 4560
1⤵
PID:1972

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4632
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:3316
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1348
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 552
  2⤵
  PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4632 -ip 4632
1⤵
PID:404

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2556
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:1052
- C:\Windows\cugcue.exe
  C:\Windows\cugcue.exe Win7
  2⤵
  PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2556 -ip 2556
1⤵
PID:388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\6726.vbs

Filesize
500B

MD5
1660bd4e6700bad46cdd230d49ef0a21

SHA1
772b03c47faf1774b867530981199fd8161a2c74

SHA256
8c3828c7611890be713f99b56efab77def8adacd1c497a853726cfcc3efb3bbb

SHA512
565a62f9d1017fc29b983d3b6012d46efaf4517132099932f1b1f93962ded1825420332c891082a1ac2844385f814c1b5facaaa2a923438a7cb8b80ec4b42ef3

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe

Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
memory/444-386-0x0000000000000000-mapping.dmp

Download
memory/532-176-0x0000000000000000-mapping.dmp

Download
memory/660-581-0x0000000000000000-mapping.dmp

Download
memory/660-136-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/720-130-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/736-516-0x0000000000000000-mapping.dmp

Download
memory/768-586-0x0000000000000000-mapping.dmp

Download
memory/1060-159-0x0000000000000000-mapping.dmp

Download
memory/1104-312-0x0000000000000000-mapping.dmp

Download
memory/1200-397-0x0000000000000000-mapping.dmp

Download
memory/1428-465-0x0000000000000000-mapping.dmp

Download
memory/1596-471-0x0000000000000000-mapping.dmp

Download
memory/1788-182-0x0000000000000000-mapping.dmp

Download
memory/1844-502-0x0000000000000000-mapping.dmp

Download
memory/1844-403-0x0000000000000000-mapping.dmp

Download
memory/1876-595-0x0000000000000000-mapping.dmp

Download
memory/1888-525-0x0000000000000000-mapping.dmp

Download
memory/1920-448-0x0000000000000000-mapping.dmp

Download
memory/1924-152-0x0000000000000000-mapping.dmp

Download
memory/2028-210-0x0000000000000000-mapping.dmp

Download
memory/2084-295-0x0000000000000000-mapping.dmp

Download
memory/2176-250-0x0000000000000000-mapping.dmp

Download
memory/2176-420-0x0000000000000000-mapping.dmp

Download
memory/2216-363-0x0000000000000000-mapping.dmp

Download
memory/2488-216-0x0000000000000000-mapping.dmp

Download
memory/2740-199-0x0000000000000000-mapping.dmp

Download
memory/2812-614-0x0000000000000000-mapping.dmp

Download
memory/3044-511-0x0000000000000000-mapping.dmp

Download
memory/3104-600-0x0000000000000000-mapping.dmp

Download
memory/3172-278-0x0000000000000000-mapping.dmp

Download
memory/3208-267-0x0000000000000000-mapping.dmp

Download
memory/3220-488-0x0000000000000000-mapping.dmp

Download
memory/3392-431-0x0000000000000000-mapping.dmp

Download
memory/3408-329-0x0000000000000000-mapping.dmp

Download
memory/3488-165-0x0000000000000000-mapping.dmp

Download
memory/3488-572-0x0000000000000000-mapping.dmp

Download
memory/3548-558-0x0000000000000000-mapping.dmp

Download
memory/3744-497-0x0000000000000000-mapping.dmp

Download
memory/3968-437-0x0000000000000000-mapping.dmp

Download
memory/3988-454-0x0000000000000000-mapping.dmp

Download
memory/3988-380-0x0000000000000000-mapping.dmp

Download
memory/4000-335-0x0000000000000000-mapping.dmp

Download
memory/4004-628-0x0000000000000000-mapping.dmp

Download
memory/4028-352-0x0000000000000000-mapping.dmp

Download
memory/4060-227-0x0000000000000000-mapping.dmp

Download
memory/4072-284-0x0000000000000000-mapping.dmp

Download
memory/4080-482-0x0000000000000000-mapping.dmp

Download
memory/4124-609-0x0000000000000000-mapping.dmp

Download
memory/4208-414-0x0000000000000000-mapping.dmp

Download
memory/4224-233-0x0000000000000000-mapping.dmp

Download
memory/4248-553-0x0000000000000000-mapping.dmp

Download
memory/4256-623-0x0000000000000000-mapping.dmp

Download
memory/4348-567-0x0000000000000000-mapping.dmp

Download
memory/4352-261-0x0000000000000000-mapping.dmp

Download
memory/4408-146-0x0000000000000000-mapping.dmp

Download
memory/4456-301-0x0000000000000000-mapping.dmp

Download
memory/4476-637-0x0000000000000000-mapping.dmp

Download
memory/4552-346-0x0000000000000000-mapping.dmp

Download
memory/4576-318-0x0000000000000000-mapping.dmp

Download
memory/4624-244-0x0000000000000000-mapping.dmp

Download
memory/4668-369-0x0000000000000000-mapping.dmp

Download
memory/4688-140-0x0000000000000000-mapping.dmp

Download
memory/4736-544-0x0000000000000000-mapping.dmp

Download
memory/4748-539-0x0000000000000000-mapping.dmp

Download
memory/5064-530-0x0000000000000000-mapping.dmp

Download
memory/5116-193-0x0000000000000000-mapping.dmp

Download