Overview
overview
7Static
static
3script.med...yer.py
windows7-x64
3script.med...yer.py
windows10-2004-x64
3script.med...ons.py
windows7-x64
3script.med...ons.py
windows10-2004-x64
3script.med...dub.py
windows7-x64
3script.med...dub.py
windows10-2004-x64
3script.med...nds.py
windows7-x64
3script.med...nds.py
windows10-2004-x64
3script.med...ase.py
windows7-x64
3script.med...ase.py
windows10-2004-x64
3script.med...ode.py
windows7-x64
3script.med...ode.py
windows10-2004-x64
3script.med...er.exe
windows7-x64
3script.med...er.exe
windows10-2004-x64
7script.med...ird.py
windows7-x64
3script.med...ird.py
windows10-2004-x64
3script.med...ext.py
windows7-x64
3script.med...ext.py
windows10-2004-x64
3script.med...ces.py
windows7-x64
3script.med...ces.py
windows10-2004-x64
3script.med...air.py
windows7-x64
3script.med...air.py
windows10-2004-x64
3script.med...rch.py
windows7-x64
3script.med...rch.py
windows10-2004-x64
3script.med...ngs.py
windows7-x64
3script.med...ngs.py
windows10-2004-x64
3script.med...lar.py
windows7-x64
3script.med...lar.py
windows10-2004-x64
3script.med...rch.py
windows7-x64
3script.med...rch.py
windows10-2004-x64
3script.med...ies.py
windows7-x64
3script.med...ies.py
windows10-2004-x64
3Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2024, 10:16
Static task
static1
Behavioral task
behavioral1
Sample
script.media.aggregator/aceplayer.py
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
script.media.aggregator/aceplayer.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
script.media.aggregator/afteractions.py
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
script.media.aggregator/afteractions.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
script.media.aggregator/anidub.py
Resource
win7-20240220-en
Behavioral task
behavioral6
Sample
script.media.aggregator/anidub.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
script.media.aggregator/backgrounds.py
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
script.media.aggregator/backgrounds.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
script.media.aggregator/base.py
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
script.media.aggregator/base.py
Resource
win10v2004-20231215-en
Behavioral task
behavioral11
Sample
script.media.aggregator/bencode.py
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
script.media.aggregator/bencode.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral13
Sample
script.media.aggregator/bin/u8runner.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
script.media.aggregator/bin/u8runner.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
script.media.aggregator/bluebird.py
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
script.media.aggregator/bluebird.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral17
Sample
script.media.aggregator/context.py
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
script.media.aggregator/context.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
script.media.aggregator/context_get_sources.py
Resource
win7-20240221-en
Behavioral task
behavioral20
Sample
script.media.aggregator/context_get_sources.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral21
Sample
script.media.aggregator/context_repair.py
Resource
win7-20240215-en
Behavioral task
behavioral22
Sample
script.media.aggregator/context_repair.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
script.media.aggregator/context_search.py
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
script.media.aggregator/context_search.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral25
Sample
script.media.aggregator/context_settings.py
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
script.media.aggregator/context_settings.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
script.media.aggregator/context_show_similar.py
Resource
win7-20240215-en
Behavioral task
behavioral28
Sample
script.media.aggregator/context_show_similar.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
script.media.aggregator/context_united_search.py
Resource
win7-20240220-en
Behavioral task
behavioral30
Sample
script.media.aggregator/context_united_search.py
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
script.media.aggregator/countries.py
Resource
win7-20231129-en
Behavioral task
behavioral32
Sample
script.media.aggregator/countries.py
Resource
win10v2004-20240226-en
General
-
Target
script.media.aggregator/bin/u8runner.exe
-
Size
21KB
-
MD5
24735674aa04d36f56c748d89f40bfc8
-
SHA1
d8ea00e14a2caced07dde803dad2f702759a93e1
-
SHA256
97eb4203ee0b6b789388b55e0550c04865d006e6df3ff7d29edadb11b2bffa45
-
SHA512
030a43a7cba0c6e75790693160fe4b8ea5802f34c03e6fcde25a44dca7bdbe32da2b0a3643f816a6175d144173d09d69a52e6ed48b8699d1469aa9e9d307fe09
-
SSDEEP
384:ROV3Ohl55MJ+PtLcFuoInpqbiEB1+9GfrBWp+G6X:gJRQFHyiEB17frm6X
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe Key value queried \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation u8runner.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3192 wrote to memory of 2920 3192 u8runner.exe 86 PID 3192 wrote to memory of 2920 3192 u8runner.exe 86 PID 3192 wrote to memory of 2920 3192 u8runner.exe 86 PID 2920 wrote to memory of 2808 2920 u8runner.exe 88 PID 2920 wrote to memory of 2808 2920 u8runner.exe 88 PID 2920 wrote to memory of 2808 2920 u8runner.exe 88 PID 2808 wrote to memory of 5004 2808 u8runner.exe 90 PID 2808 wrote to memory of 5004 2808 u8runner.exe 90 PID 2808 wrote to memory of 5004 2808 u8runner.exe 90 PID 5004 wrote to memory of 1416 5004 u8runner.exe 92 PID 5004 wrote to memory of 1416 5004 u8runner.exe 92 PID 5004 wrote to memory of 1416 5004 u8runner.exe 92 PID 1416 wrote to memory of 1932 1416 u8runner.exe 94 PID 1416 wrote to memory of 1932 1416 u8runner.exe 94 PID 1416 wrote to memory of 1932 1416 u8runner.exe 94 PID 1932 wrote to memory of 2528 1932 u8runner.exe 96 PID 1932 wrote to memory of 2528 1932 u8runner.exe 96 PID 1932 wrote to memory of 2528 1932 u8runner.exe 96 PID 2528 wrote to memory of 1044 2528 u8runner.exe 98 PID 2528 wrote to memory of 1044 2528 u8runner.exe 98 PID 2528 wrote to memory of 1044 2528 u8runner.exe 98 PID 1044 wrote to memory of 4752 1044 u8runner.exe 100 PID 1044 wrote to memory of 4752 1044 u8runner.exe 100 PID 1044 wrote to memory of 4752 1044 u8runner.exe 100 PID 4752 wrote to memory of 3316 4752 u8runner.exe 102 PID 4752 wrote to memory of 3316 4752 u8runner.exe 102 PID 4752 wrote to memory of 3316 4752 u8runner.exe 102 PID 3316 wrote to memory of 2036 3316 u8runner.exe 104 PID 3316 wrote to memory of 2036 3316 u8runner.exe 104 PID 3316 wrote to memory of 2036 3316 u8runner.exe 104 PID 2036 wrote to memory of 2480 2036 u8runner.exe 106 PID 2036 wrote to memory of 2480 2036 u8runner.exe 106 PID 2036 wrote to memory of 2480 2036 u8runner.exe 106 PID 2480 wrote to memory of 724 2480 u8runner.exe 108 PID 2480 wrote to memory of 724 2480 u8runner.exe 108 PID 2480 wrote to memory of 724 2480 u8runner.exe 108 PID 724 wrote to memory of 3044 724 u8runner.exe 110 PID 724 wrote to memory of 3044 724 u8runner.exe 110 PID 724 wrote to memory of 3044 724 u8runner.exe 110 PID 3044 wrote to memory of 4116 3044 u8runner.exe 112 PID 3044 wrote to memory of 4116 3044 u8runner.exe 112 PID 3044 wrote to memory of 4116 3044 u8runner.exe 112 PID 4116 wrote to memory of 964 4116 u8runner.exe 114 PID 4116 wrote to memory of 964 4116 u8runner.exe 114 PID 4116 wrote to memory of 964 4116 u8runner.exe 114 PID 964 wrote to memory of 4244 964 u8runner.exe 116 PID 964 wrote to memory of 4244 964 u8runner.exe 116 PID 964 wrote to memory of 4244 964 u8runner.exe 116 PID 4244 wrote to memory of 3536 4244 u8runner.exe 118 PID 4244 wrote to memory of 3536 4244 u8runner.exe 118 PID 4244 wrote to memory of 3536 4244 u8runner.exe 118 PID 3536 wrote to memory of 4024 3536 u8runner.exe 120 PID 3536 wrote to memory of 4024 3536 u8runner.exe 120 PID 3536 wrote to memory of 4024 3536 u8runner.exe 120 PID 4024 wrote to memory of 1040 4024 u8runner.exe 122 PID 4024 wrote to memory of 1040 4024 u8runner.exe 122 PID 4024 wrote to memory of 1040 4024 u8runner.exe 122 PID 1040 wrote to memory of 2652 1040 u8runner.exe 124 PID 1040 wrote to memory of 2652 1040 u8runner.exe 124 PID 1040 wrote to memory of 2652 1040 u8runner.exe 124 PID 2652 wrote to memory of 3172 2652 u8runner.exe 128 PID 2652 wrote to memory of 3172 2652 u8runner.exe 128 PID 2652 wrote to memory of 3172 2652 u8runner.exe 128 PID 3172 wrote to memory of 4364 3172 u8runner.exe 130
Processes
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"4⤵
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"6⤵
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"8⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"9⤵
- Suspicious use of WriteProcessMemory
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"10⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"11⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"12⤵
- Suspicious use of WriteProcessMemory
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"13⤵
- Suspicious use of WriteProcessMemory
PID:724 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"14⤵
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"15⤵
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"16⤵
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"17⤵
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"18⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"19⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"20⤵
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"21⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"22⤵
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"23⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"24⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"25⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"26⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"27⤵
- Checks computer location settings
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"28⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"29⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"30⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"31⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"32⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"33⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"34⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"35⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"36⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"37⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"38⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"39⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"40⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"41⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"42⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"43⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"44⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"45⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"46⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"47⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"48⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"49⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"50⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"51⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"52⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"53⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"54⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"55⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"56⤵
- Checks computer location settings
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"57⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"58⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"59⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"60⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"61⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"62⤵
- Checks computer location settings
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"63⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"64⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"65⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"66⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"67⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"68⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"69⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"70⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"71⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"72⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"73⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"74⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"75⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"76⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"77⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"78⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"79⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"80⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"81⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"82⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"83⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"84⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"85⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"86⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"87⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"88⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"89⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"90⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"91⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"92⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"93⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"94⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"95⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"96⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"97⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"98⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"99⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"100⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"101⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"102⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"103⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"104⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"105⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"106⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"107⤵
- Checks computer location settings
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"108⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"109⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"110⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"111⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"112⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"113⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"114⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"115⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"116⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"117⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"118⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"119⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"120⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"121⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"C:\Users\Admin\AppData\Local\Temp\script.media.aggregator\bin\u8runner.exe"122⤵PID:1276
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-