Technical Information
- %HOMEPATH%\documents\itbema.exe
- %HOMEPATH%\documents\itbema.exe
- 'r8####.###-cn-beijing.aliyuncs.com':443
- '34.##9.100.209':443
- 'r8####.###-cn-beijing.aliyuncs.com':443
- DNS ASK r8####.###-cn-beijing.aliyuncs.com
- '%HOMEPATH%\documents\itbema.exe'
- '<SYSTEM32>\taskeng.exe' {78012462-A9F7-4A86-945E-384E4EE51577} S-1-5-21-3691498038-2086406363-2140527554-1000:sdzjayfpve\user:Interactive:[1]
- '%HOMEPATH%\documents\itbema.exe' ' (with hidden window)