gh0strat | ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

Analysis

max time kernel
151s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
09-05-2022 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

589.exe
Size

216KB
MD5

a824640862ea34979abb4d80f2ee07b1
SHA1

529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed
SHA256

ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21
SHA512

99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Score

10^/10

gh0strat rat

Malware Config

Signatures

Gh0st RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/720-130-0x0000000010000000-0x0000000010033000-memory.dmp	family_gh0strat
behavioral2/memory/660-136-0x0000000010000000-0x0000000010033000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Executes dropped EXE 64 IoCs

Processes:

cugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.exe

pid	process
660	cugcue.exe
4688	cugcue.exe
4408	cugcue.exe
4568	cugcue.exe
1060	cugcue.exe
3488	cugcue.exe
4832	cugcue.exe
532	cugcue.exe
1788	cugcue.exe
2468	cugcue.exe
5116	cugcue.exe
2740	cugcue.exe
3984	cugcue.exe
2028	cugcue.exe
2488	cugcue.exe
3092	cugcue.exe
4060	cugcue.exe
4224	cugcue.exe
3356	cugcue.exe
4624	cugcue.exe
2176	cugcue.exe
4708	cugcue.exe
4352	cugcue.exe
3208	cugcue.exe
4412	cugcue.exe
3172	cugcue.exe
4072	cugcue.exe
1672	cugcue.exe
2084	cugcue.exe
4456	cugcue.exe
2244	cugcue.exe
1104	cugcue.exe
4576	cugcue.exe
4824	cugcue.exe
3408	cugcue.exe
4000	cugcue.exe
4016	cugcue.exe
4552	cugcue.exe
4028	cugcue.exe
3156	cugcue.exe
2216	cugcue.exe
4668	cugcue.exe
2100	cugcue.exe
3988	cugcue.exe
444	cugcue.exe
2916	cugcue.exe
1200	cugcue.exe
1844	cugcue.exe
4664	cugcue.exe
4208	cugcue.exe
2176	cugcue.exe
5036	cugcue.exe
3392	cugcue.exe
3968	cugcue.exe
3292	cugcue.exe
1920	cugcue.exe
3988	cugcue.exe
1980	cugcue.exe
1428	cugcue.exe
1596	cugcue.exe
3080	cugcue.exe
4080	cugcue.exe
3220	cugcue.exe
544	cugcue.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

589.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation 589.exe
Drops file in Windows directory 2 IoCs

Processes:

589.exe

description ioc process

File created C:\Windows\cugcue.exe 589.exe
File opened for modification C:\Windows\cugcue.exe 589.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation	589.exe

description	ioc	process
File created	C:\Windows\cugcue.exe	589.exe
File opened for modification	C:\Windows\cugcue.exe	589.exe

Program crash 64 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3956	660	WerFault.exe	cugcue.exe
3804	4568	WerFault.exe	cugcue.exe
4936	4832	WerFault.exe	cugcue.exe
3048	2468	WerFault.exe	cugcue.exe
3140	3984	WerFault.exe	cugcue.exe
3132	3092	WerFault.exe	cugcue.exe
940	3356	WerFault.exe	cugcue.exe
4744	4708	WerFault.exe	cugcue.exe
3088	4412	WerFault.exe	cugcue.exe
4560	1672	WerFault.exe	cugcue.exe
1788	2244	WerFault.exe	cugcue.exe
3412	4824	WerFault.exe	cugcue.exe
4888	4016	WerFault.exe	cugcue.exe
3208	3156	WerFault.exe	cugcue.exe
4860	2100	WerFault.exe	cugcue.exe
5116	2916	WerFault.exe	cugcue.exe
4140	4664	WerFault.exe	cugcue.exe
1404	5036	WerFault.exe	cugcue.exe
3316	3292	WerFault.exe	cugcue.exe
2432	1980	WerFault.exe	cugcue.exe
3412	3080	WerFault.exe	cugcue.exe
3556	544	WerFault.exe	cugcue.exe
4076	4548	WerFault.exe	cugcue.exe
2176	4964	WerFault.exe	cugcue.exe
3604	4244	WerFault.exe	cugcue.exe
316	3608	WerFault.exe	cugcue.exe
3904	3980	WerFault.exe	cugcue.exe
4520	1992	WerFault.exe	cugcue.exe
1784	1268	WerFault.exe	cugcue.exe
4796	3408	WerFault.exe	cugcue.exe
4556	2916	WerFault.exe	cugcue.exe
1364	1340	WerFault.exe	cugcue.exe
4964	3732	WerFault.exe	cugcue.exe
2096	2940	WerFault.exe	cugcue.exe
4204	1884	WerFault.exe	cugcue.exe
4728	4032	WerFault.exe	cugcue.exe
3292	4996	WerFault.exe	cugcue.exe
3048	3268	WerFault.exe	cugcue.exe
4152	1876	WerFault.exe	cugcue.exe
1844	2812	WerFault.exe	cugcue.exe
1188	1408	WerFault.exe	cugcue.exe
4476	1592	WerFault.exe	cugcue.exe
2748	3924	WerFault.exe	cugcue.exe
2128	4240	WerFault.exe	cugcue.exe
1708	4660	WerFault.exe	cugcue.exe
4156	1884	WerFault.exe	cugcue.exe
400	1680	WerFault.exe	cugcue.exe
2740	1604	WerFault.exe	cugcue.exe
312	3808	WerFault.exe	cugcue.exe
1496	508	WerFault.exe	cugcue.exe
5076	3452	WerFault.exe	cugcue.exe
4820	4556	WerFault.exe	cugcue.exe
3972	4888	WerFault.exe	cugcue.exe
3128	2124	WerFault.exe	cugcue.exe
4904	308	WerFault.exe	cugcue.exe
1140	316	WerFault.exe	cugcue.exe
3516	1548	WerFault.exe	cugcue.exe
4780	3488	WerFault.exe	cugcue.exe
2608	3804	WerFault.exe	cugcue.exe
1392	1604	WerFault.exe	cugcue.exe
3408	728	WerFault.exe	cugcue.exe
4656	3956	WerFault.exe	cugcue.exe
612	4652	WerFault.exe	cugcue.exe
2568	4516	WerFault.exe	cugcue.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

cugcue.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cugcue.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	cugcue.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

cugcue.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	cugcue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	cugcue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	cugcue.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	cugcue.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	cugcue.exe

Modifies registry class 1 IoCs

Processes:

589.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings 589.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000_Classes\Local Settings	589.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

cugcue.exe

pid	process
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe
4688	cugcue.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cugcue.exe589.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.execugcue.exe

description	pid	process	target process
PID 660 wrote to memory of 4688	660	cugcue.exe	cugcue.exe
PID 660 wrote to memory of 4688	660	cugcue.exe	cugcue.exe
PID 660 wrote to memory of 4688	660	cugcue.exe	cugcue.exe
PID 660 wrote to memory of 4408	660	cugcue.exe	cugcue.exe
PID 660 wrote to memory of 4408	660	cugcue.exe	cugcue.exe
PID 660 wrote to memory of 4408	660	cugcue.exe	cugcue.exe
PID 720 wrote to memory of 1924	720	589.exe	WScript.exe
PID 720 wrote to memory of 1924	720	589.exe	WScript.exe
PID 720 wrote to memory of 1924	720	589.exe	WScript.exe
PID 4568 wrote to memory of 1060	4568	cugcue.exe	cugcue.exe
PID 4568 wrote to memory of 1060	4568	cugcue.exe	cugcue.exe
PID 4568 wrote to memory of 1060	4568	cugcue.exe	cugcue.exe
PID 4568 wrote to memory of 3488	4568	cugcue.exe	cugcue.exe
PID 4568 wrote to memory of 3488	4568	cugcue.exe	cugcue.exe
PID 4568 wrote to memory of 3488	4568	cugcue.exe	cugcue.exe
PID 4832 wrote to memory of 532	4832	cugcue.exe	cugcue.exe
PID 4832 wrote to memory of 532	4832	cugcue.exe	cugcue.exe
PID 4832 wrote to memory of 532	4832	cugcue.exe	cugcue.exe
PID 4832 wrote to memory of 1788	4832	cugcue.exe	cugcue.exe
PID 4832 wrote to memory of 1788	4832	cugcue.exe	cugcue.exe
PID 4832 wrote to memory of 1788	4832	cugcue.exe	cugcue.exe
PID 2468 wrote to memory of 5116	2468	cugcue.exe	cugcue.exe
PID 2468 wrote to memory of 5116	2468	cugcue.exe	cugcue.exe
PID 2468 wrote to memory of 5116	2468	cugcue.exe	cugcue.exe
PID 2468 wrote to memory of 2740	2468	cugcue.exe	cugcue.exe
PID 2468 wrote to memory of 2740	2468	cugcue.exe	cugcue.exe
PID 2468 wrote to memory of 2740	2468	cugcue.exe	cugcue.exe
PID 3984 wrote to memory of 2028	3984	cugcue.exe	cugcue.exe
PID 3984 wrote to memory of 2028	3984	cugcue.exe	cugcue.exe
PID 3984 wrote to memory of 2028	3984	cugcue.exe	cugcue.exe
PID 3984 wrote to memory of 2488	3984	cugcue.exe	cugcue.exe
PID 3984 wrote to memory of 2488	3984	cugcue.exe	cugcue.exe
PID 3984 wrote to memory of 2488	3984	cugcue.exe	cugcue.exe
PID 3092 wrote to memory of 4060	3092	cugcue.exe	cugcue.exe
PID 3092 wrote to memory of 4060	3092	cugcue.exe	cugcue.exe
PID 3092 wrote to memory of 4060	3092	cugcue.exe	cugcue.exe
PID 3092 wrote to memory of 4224	3092	cugcue.exe	cugcue.exe
PID 3092 wrote to memory of 4224	3092	cugcue.exe	cugcue.exe
PID 3092 wrote to memory of 4224	3092	cugcue.exe	cugcue.exe
PID 3356 wrote to memory of 4624	3356	cugcue.exe	cugcue.exe
PID 3356 wrote to memory of 4624	3356	cugcue.exe	cugcue.exe
PID 3356 wrote to memory of 4624	3356	cugcue.exe	cugcue.exe
PID 3356 wrote to memory of 2176	3356	cugcue.exe	cugcue.exe
PID 3356 wrote to memory of 2176	3356	cugcue.exe	cugcue.exe
PID 3356 wrote to memory of 2176	3356	cugcue.exe	cugcue.exe
PID 4708 wrote to memory of 4352	4708	cugcue.exe	cugcue.exe
PID 4708 wrote to memory of 4352	4708	cugcue.exe	cugcue.exe
PID 4708 wrote to memory of 4352	4708	cugcue.exe	cugcue.exe
PID 4708 wrote to memory of 3208	4708	cugcue.exe	cugcue.exe
PID 4708 wrote to memory of 3208	4708	cugcue.exe	cugcue.exe
PID 4708 wrote to memory of 3208	4708	cugcue.exe	cugcue.exe
PID 4412 wrote to memory of 3172	4412	cugcue.exe	cugcue.exe
PID 4412 wrote to memory of 3172	4412	cugcue.exe	cugcue.exe
PID 4412 wrote to memory of 3172	4412	cugcue.exe	cugcue.exe
PID 4412 wrote to memory of 4072	4412	cugcue.exe	cugcue.exe
PID 4412 wrote to memory of 4072	4412	cugcue.exe	cugcue.exe
PID 4412 wrote to memory of 4072	4412	cugcue.exe	cugcue.exe
PID 1672 wrote to memory of 2084	1672	cugcue.exe	cugcue.exe
PID 1672 wrote to memory of 2084	1672	cugcue.exe	cugcue.exe
PID 1672 wrote to memory of 2084	1672	cugcue.exe	cugcue.exe
PID 1672 wrote to memory of 4456	1672	cugcue.exe	cugcue.exe
PID 1672 wrote to memory of 4456	1672	cugcue.exe	cugcue.exe
PID 1672 wrote to memory of 4456	1672	cugcue.exe	cugcue.exe
PID 2244 wrote to memory of 1104	2244	cugcue.exe	cugcue.exe

C:\Users\Admin\AppData\Local\Temp\589.exe
"C:\Users\Admin\AppData\Local\Temp\589.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:720

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\6726.vbs"
2⤵
PID:1924

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:660

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4688

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 660 -s 588
2⤵
- Program crash
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 660 -ip 660
1⤵
PID:1544

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1060

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4568 -s 552
2⤵
- Program crash
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4568 -ip 4568
1⤵
PID:1220

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:532

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 620
2⤵
- Program crash
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4832 -ip 4832
1⤵
PID:1860

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:5116

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 544
2⤵
- Program crash
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2468 -ip 2468
1⤵
PID:3760

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2028

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3984 -s 620
2⤵
- Program crash
PID:3140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3984 -ip 3984
1⤵
PID:4052

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4060

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3092 -s 552
2⤵
- Program crash
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 3092 -ip 3092
1⤵
PID:4964

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4624

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3356 -s 612
2⤵
- Program crash
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 588 -p 3356 -ip 3356
1⤵
PID:2068

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4352

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 552
2⤵
- Program crash
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 4708 -ip 4708
1⤵
PID:1632

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3172

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 552
2⤵
- Program crash
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 4412 -ip 4412
1⤵
PID:8

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2084

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 552
2⤵
- Program crash
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1672 -ip 1672
1⤵
PID:4520

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1104

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 620
2⤵
- Program crash
PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2244 -ip 2244
1⤵
PID:3768

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:4824

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3408

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4824 -s 552
2⤵
- Program crash
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4824 -ip 4824
1⤵
PID:2160

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:4016

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4552

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4016 -s 620
2⤵
- Program crash
PID:4888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4016 -ip 4016
1⤵
PID:5028

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:3156

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2216

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3156 -s 612
2⤵
- Program crash
PID:3208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3156 -ip 3156
1⤵
PID:4204

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:2100

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3988

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 620
2⤵
- Program crash
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 2100 -ip 2100
1⤵
PID:4544

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:2916

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1200

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 552
2⤵
- Program crash
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 2916 -ip 2916
1⤵
PID:4948

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:4664

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4208

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4664 -s 608
2⤵
- Program crash
PID:4140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 4664 -ip 4664
1⤵
PID:2336

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:5036

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3392

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5036 -s 640
2⤵
- Program crash
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5036 -ip 5036
1⤵
PID:2868

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:3292

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1920

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3292 -s 620
2⤵
- Program crash
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 3292 -ip 3292
1⤵
PID:1972

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:1980

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1428

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:1596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1980 -s 552
2⤵
- Program crash
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 1980 -ip 1980
1⤵
PID:4192

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:3080

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:4080

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
- Executes dropped EXE
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3080 -s 552
2⤵
- Program crash
PID:3412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 3080 -ip 3080
1⤵
PID:2284

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
- Executes dropped EXE
PID:544

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3744

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 620
2⤵
- Program crash
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 544 -ip 544
1⤵
PID:5068

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3044

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 552
2⤵
- Program crash
PID:4076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 4548 -ip 4548
1⤵
PID:2068

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4964

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1888

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 632
2⤵
- Program crash
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 4964 -ip 4964
1⤵
PID:4732

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4244

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4748

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4244 -s 552
2⤵
- Program crash
PID:3604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 4244 -ip 4244
1⤵
PID:2216

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3608

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4248

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3608 -s 620
2⤵
- Program crash
PID:316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 3608 -ip 3608
1⤵
PID:1336

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3980

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4348

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3980 -s 592
2⤵
- Program crash
PID:3904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 3980 -ip 3980
1⤵
PID:3984

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1992

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:660

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1992 -s 552
2⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 1992 -ip 1992
1⤵
PID:3248

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1268

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1876

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 552
2⤵
- Program crash
PID:1784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1268 -ip 1268
1⤵
PID:2372

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3408

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4124

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 620
2⤵
- Program crash
PID:4796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3408 -ip 3408
1⤵
PID:3080

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2916

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4256

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2916 -s 620
2⤵
- Program crash
PID:4556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2916 -ip 2916
1⤵
PID:3864

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1340

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4476

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1340 -s 612
2⤵
- Program crash
PID:1364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1340 -ip 1340
1⤵
PID:3044

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3732

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1452

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3732 -s 204
2⤵
- Program crash
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 3732 -ip 3732
1⤵
PID:2124

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2940

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2052

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2940 -s 552
2⤵
- Program crash
PID:2096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 2940 -ip 2940
1⤵
PID:720

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1884

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1404

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 588
2⤵
- Program crash
PID:4204

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 1884 -ip 1884
1⤵
PID:4568

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4032

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1680

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 588
2⤵
- Program crash
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 4032 -ip 4032
1⤵
PID:1548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4996

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1604

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4412

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4996 -s 552
2⤵
- Program crash
PID:3292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 4996 -ip 4996
1⤵
PID:3988

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3268

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3796

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 552
2⤵
- Program crash
PID:3048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 832 -p 3268 -ip 3268
1⤵
PID:1052

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1876

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5112

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1876 -s 620
2⤵
- Program crash
PID:4152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1876 -ip 1876
1⤵
PID:2024

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2812

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3636

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 556
2⤵
- Program crash
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2812 -ip 2812
1⤵
PID:3452

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1408

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2468

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1408 -s 620
2⤵
- Program crash
PID:1188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1408 -ip 1408
1⤵
PID:5028

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1592

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3560

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1592 -s 556
2⤵
- Program crash
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 1592 -ip 1592
1⤵
PID:2144

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3924

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3008

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 552
2⤵
- Program crash
PID:2748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 3924 -ip 3924
1⤵
PID:4856

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4240

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3188

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4240 -s 552
2⤵
- Program crash
PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 808 -p 4240 -ip 4240
1⤵
PID:4748

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4660

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5084

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4660 -s 588
2⤵
- Program crash
PID:1708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4660 -ip 4660
1⤵
PID:1672

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1884

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:8

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1884 -s 620
2⤵
- Program crash
PID:4156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 1884 -ip 1884
1⤵
PID:3572

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1680

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4972

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 552
2⤵
- Program crash
PID:400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1680 -ip 1680
1⤵
PID:2884

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1604

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1104

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 556
2⤵
- Program crash
PID:2740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1604 -ip 1604
1⤵
PID:1788

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3808

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3012

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3808 -s 620
2⤵
- Program crash
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3808 -ip 3808
1⤵
PID:1200

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:508

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3088

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 508 -s 620
2⤵
- Program crash
PID:1496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 508 -ip 508
1⤵
PID:800

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3452

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2864

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3452 -s 552
2⤵
- Program crash
PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 3452 -ip 3452
1⤵
PID:3556

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4556

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1520

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4556 -s 620
2⤵
- Program crash
PID:4820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 4556 -ip 4556
1⤵
PID:4084

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4888

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1364

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4888 -s 556
2⤵
- Program crash
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1008 -p 4888 -ip 4888
1⤵
PID:5100

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2124

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4112

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2124 -s 552
2⤵
- Program crash
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 2124 -ip 2124
1⤵
PID:4440

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:308

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1236

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 308 -s 552
2⤵
- Program crash
PID:4904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 308 -ip 308
1⤵
PID:2096

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:316

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1672

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 316 -s 552
2⤵
- Program crash
PID:1140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 316 -ip 316
1⤵
PID:1968

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1972

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 620
2⤵
- Program crash
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 1548 -ip 1548
1⤵
PID:4456

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3488

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4544

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3488 -s 620
2⤵
- Program crash
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3488 -ip 3488
1⤵
PID:4760

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3804

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1596

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3804 -s 544
2⤵
- Program crash
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 3804 -ip 3804
1⤵
PID:2448

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1604

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3204

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1604 -s 620
2⤵
- Program crash
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 1604 -ip 1604
1⤵
PID:4824

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:728

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4196

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 728 -s 600
2⤵
- Program crash
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 728 -ip 728
1⤵
PID:5096

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3956

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2784

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3956 -s 552
2⤵
- Program crash
PID:4656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3956 -ip 3956
1⤵
PID:3252

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4652

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2816

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 552
2⤵
- Program crash
PID:612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 4652 -ip 4652
1⤵
PID:3308

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4516

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3004

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4516 -s 552
2⤵
- Program crash
PID:2568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4516 -ip 4516
1⤵
PID:2288

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3560

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5064

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3560 -s 556
2⤵
PID:4964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 3560 -ip 3560
1⤵
PID:4548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3924

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2788

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3924 -s 552
2⤵
PID:1916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3924 -ip 3924
1⤵
PID:3492

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1280

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4904

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 560
2⤵
PID:1076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 1280 -ip 1280
1⤵
PID:3548

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3664

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4560

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3664 -s 552
2⤵
PID:3716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 3664 -ip 3664
1⤵
PID:316

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4036

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3056

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4036 -s 592
2⤵
PID:2524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4036 -ip 4036
1⤵
PID:3572

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4024

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5032

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 616
2⤵
PID:3488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4024 -ip 4024
1⤵
PID:1060

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1244

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1980

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1244 -s 552
2⤵
PID:3804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 1244 -ip 1244
1⤵
PID:4072

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4152

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2304

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 552
2⤵
PID:1604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 4152 -ip 4152
1⤵
PID:4080

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3180

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1920

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3180 -s 556
2⤵
PID:728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 3180 -ip 3180
1⤵
PID:660

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3132

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1676

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3132 -s 620
2⤵
PID:3088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 3132 -ip 3132
1⤵
PID:2260

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1844

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1624

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:5068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1844 -s 620
2⤵
PID:3660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 1844 -ip 1844
1⤵
PID:3044

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:3480

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1724

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:876

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3480 -s 552
2⤵
PID:3420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 3480 -ip 3480
1⤵
PID:1340

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:364

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2400

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 364 -s 552
2⤵
PID:3612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 364 -ip 364
1⤵
PID:2536

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1856

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3772

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1856 -s 612
2⤵
PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 1856 -ip 1856
1⤵
PID:736

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4968

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4224

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4968 -s 552
2⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 984 -p 4968 -ip 4968
1⤵
PID:720

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2440

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3820

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 556
2⤵
PID:208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 2440 -ip 2440
1⤵
PID:1708

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:1280

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4604

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1280 -s 588
2⤵
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1280 -ip 1280
1⤵
PID:4296

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4560

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4712

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4560 -s 552
2⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 4560 -ip 4560
1⤵
PID:1972

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:4632

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:3316

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 552
2⤵
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 4632 -ip 4632
1⤵
PID:404

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe
1⤵
PID:2556

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:1052

C:\Windows\cugcue.exe
C:\Windows\cugcue.exe Win7
2⤵
PID:4720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 2556 -ip 2556
1⤵
PID:388

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\6726.vbs
Filesize
500B

MD5
1660bd4e6700bad46cdd230d49ef0a21

SHA1
772b03c47faf1774b867530981199fd8161a2c74

SHA256
8c3828c7611890be713f99b56efab77def8adacd1c497a853726cfcc3efb3bbb

SHA512
565a62f9d1017fc29b983d3b6012d46efaf4517132099932f1b1f93962ded1825420332c891082a1ac2844385f814c1b5facaaa2a923438a7cb8b80ec4b42ef3

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
C:\Windows\cugcue.exe
Filesize
216KB

MD5
a824640862ea34979abb4d80f2ee07b1

SHA1
529fbd21cf1eb8cdbd5cbc9c59c074cebd8262ed

SHA256
ca15a055b2e1d06a8fbd3a22341aeda29bbc19688b778dc3a15c615f0367bc21

SHA512
99913dfc1b95b04d76df0705d1c17d01ba54a9d4f3c0cdcd8e96763ad72933489ac7793b87926542aa5f63ae58fb0899605432913daada556ffbc4c8e279339e

Download Submit
memory/444-386-0x0000000000000000-mapping.dmp

Download
memory/532-176-0x0000000000000000-mapping.dmp

Download
memory/660-581-0x0000000000000000-mapping.dmp

Download
memory/660-136-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/720-130-0x0000000010000000-0x0000000010033000-memory.dmp

Filesize
204KB

Download
memory/736-516-0x0000000000000000-mapping.dmp

Download
memory/768-586-0x0000000000000000-mapping.dmp

Download
memory/1060-159-0x0000000000000000-mapping.dmp

Download
memory/1104-312-0x0000000000000000-mapping.dmp

Download
memory/1200-397-0x0000000000000000-mapping.dmp

Download
memory/1428-465-0x0000000000000000-mapping.dmp

Download
memory/1596-471-0x0000000000000000-mapping.dmp

Download
memory/1788-182-0x0000000000000000-mapping.dmp

Download
memory/1844-502-0x0000000000000000-mapping.dmp

Download
memory/1844-403-0x0000000000000000-mapping.dmp

Download
memory/1876-595-0x0000000000000000-mapping.dmp

Download
memory/1888-525-0x0000000000000000-mapping.dmp

Download
memory/1920-448-0x0000000000000000-mapping.dmp

Download
memory/1924-152-0x0000000000000000-mapping.dmp

Download
memory/2028-210-0x0000000000000000-mapping.dmp

Download
memory/2084-295-0x0000000000000000-mapping.dmp

Download
memory/2176-250-0x0000000000000000-mapping.dmp

Download
memory/2176-420-0x0000000000000000-mapping.dmp

Download
memory/2216-363-0x0000000000000000-mapping.dmp

Download
memory/2488-216-0x0000000000000000-mapping.dmp

Download
memory/2740-199-0x0000000000000000-mapping.dmp

Download
memory/2812-614-0x0000000000000000-mapping.dmp

Download
memory/3044-511-0x0000000000000000-mapping.dmp

Download
memory/3104-600-0x0000000000000000-mapping.dmp

Download
memory/3172-278-0x0000000000000000-mapping.dmp

Download
memory/3208-267-0x0000000000000000-mapping.dmp

Download
memory/3220-488-0x0000000000000000-mapping.dmp

Download
memory/3392-431-0x0000000000000000-mapping.dmp

Download
memory/3408-329-0x0000000000000000-mapping.dmp

Download
memory/3488-165-0x0000000000000000-mapping.dmp

Download
memory/3488-572-0x0000000000000000-mapping.dmp

Download
memory/3548-558-0x0000000000000000-mapping.dmp

Download
memory/3744-497-0x0000000000000000-mapping.dmp

Download
memory/3968-437-0x0000000000000000-mapping.dmp

Download
memory/3988-454-0x0000000000000000-mapping.dmp

Download
memory/3988-380-0x0000000000000000-mapping.dmp

Download
memory/4000-335-0x0000000000000000-mapping.dmp

Download
memory/4004-628-0x0000000000000000-mapping.dmp

Download
memory/4028-352-0x0000000000000000-mapping.dmp

Download
memory/4060-227-0x0000000000000000-mapping.dmp

Download
memory/4072-284-0x0000000000000000-mapping.dmp

Download
memory/4080-482-0x0000000000000000-mapping.dmp

Download
memory/4124-609-0x0000000000000000-mapping.dmp

Download
memory/4208-414-0x0000000000000000-mapping.dmp

Download
memory/4224-233-0x0000000000000000-mapping.dmp

Download
memory/4248-553-0x0000000000000000-mapping.dmp

Download
memory/4256-623-0x0000000000000000-mapping.dmp

Download
memory/4348-567-0x0000000000000000-mapping.dmp

Download
memory/4352-261-0x0000000000000000-mapping.dmp

Download
memory/4408-146-0x0000000000000000-mapping.dmp

Download
memory/4456-301-0x0000000000000000-mapping.dmp

Download
memory/4476-637-0x0000000000000000-mapping.dmp

Download
memory/4552-346-0x0000000000000000-mapping.dmp

Download
memory/4576-318-0x0000000000000000-mapping.dmp

Download
memory/4624-244-0x0000000000000000-mapping.dmp

Download
memory/4668-369-0x0000000000000000-mapping.dmp

Download
memory/4688-140-0x0000000000000000-mapping.dmp

Download
memory/4736-544-0x0000000000000000-mapping.dmp

Download
memory/4748-539-0x0000000000000000-mapping.dmp

Download
memory/5064-530-0x0000000000000000-mapping.dmp

Download
memory/5116-193-0x0000000000000000-mapping.dmp

Download