Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2024, 04:17
Behavioral task
behavioral1
Sample
e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe
Resource
win7-20241010-en
General
-
Target
e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe
-
Size
1.8MB
-
MD5
3a2ede71f2e43c9d6f9ec95d53c64048
-
SHA1
4091e159683f4283cf983ae59bd852a537cda660
-
SHA256
e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4
-
SHA512
0ede79c8874c1a47acbfa91b702db222ac4d26bd200b8a84212fa6a3f3f1aedcb99544124536758a86b07cda93ebb3e9c3bc6a9e73699075155817cf86f996c9
-
SSDEEP
49152:BezaTF8FcNkNdfE0pZ9ozt4wIC5aIwC+Agr6SGtgf:BemTLkNdfE0pZrw6
Malware Config
Signatures
-
KPOT Core Executable 33 IoCs
resource yara_rule behavioral2/files/0x000b000000023b77-5.dat family_kpot behavioral2/files/0x000a000000023b7c-9.dat family_kpot behavioral2/files/0x000a000000023b7b-15.dat family_kpot behavioral2/files/0x0031000000023b81-38.dat family_kpot behavioral2/files/0x000a000000023b7e-39.dat family_kpot behavioral2/files/0x000a000000023b83-54.dat family_kpot behavioral2/files/0x000a000000023b85-70.dat family_kpot behavioral2/files/0x000a000000023b87-80.dat family_kpot behavioral2/files/0x000a000000023b8a-90.dat family_kpot behavioral2/files/0x000a000000023b8e-110.dat family_kpot behavioral2/files/0x000a000000023b94-140.dat family_kpot behavioral2/files/0x000a000000023b97-163.dat family_kpot behavioral2/files/0x000a000000023b9a-170.dat family_kpot behavioral2/files/0x000a000000023b98-168.dat family_kpot behavioral2/files/0x000a000000023b99-165.dat family_kpot behavioral2/files/0x000a000000023b96-158.dat family_kpot behavioral2/files/0x000a000000023b95-153.dat family_kpot behavioral2/files/0x000a000000023b93-143.dat family_kpot behavioral2/files/0x000a000000023b92-138.dat family_kpot behavioral2/files/0x000a000000023b91-133.dat family_kpot behavioral2/files/0x000a000000023b90-129.dat family_kpot behavioral2/files/0x000a000000023b8f-122.dat family_kpot behavioral2/files/0x000a000000023b8d-113.dat family_kpot behavioral2/files/0x000a000000023b8c-108.dat family_kpot behavioral2/files/0x000a000000023b8b-103.dat family_kpot behavioral2/files/0x000a000000023b89-93.dat family_kpot behavioral2/files/0x000a000000023b88-88.dat family_kpot behavioral2/files/0x000a000000023b86-76.dat family_kpot behavioral2/files/0x000a000000023b84-66.dat family_kpot behavioral2/files/0x000a000000023b82-59.dat family_kpot behavioral2/files/0x0031000000023b80-44.dat family_kpot behavioral2/files/0x0031000000023b7f-41.dat family_kpot behavioral2/files/0x000a000000023b7d-28.dat family_kpot -
XMRig Miner payload 64 IoCs
resource yara_rule behavioral2/memory/1924-0-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp xmrig behavioral2/files/0x000b000000023b77-5.dat xmrig behavioral2/files/0x000a000000023b7c-9.dat xmrig behavioral2/files/0x000a000000023b7b-15.dat xmrig behavioral2/memory/1392-13-0x00007FF6D63C0000-0x00007FF6D6714000-memory.dmp xmrig behavioral2/files/0x0031000000023b81-38.dat xmrig behavioral2/files/0x000a000000023b7e-39.dat xmrig behavioral2/files/0x000a000000023b83-54.dat xmrig behavioral2/files/0x000a000000023b85-70.dat xmrig behavioral2/files/0x000a000000023b87-80.dat xmrig behavioral2/files/0x000a000000023b8a-90.dat xmrig behavioral2/files/0x000a000000023b8e-110.dat xmrig behavioral2/files/0x000a000000023b94-140.dat xmrig behavioral2/files/0x000a000000023b97-163.dat xmrig behavioral2/memory/400-564-0x00007FF605B10000-0x00007FF605E64000-memory.dmp xmrig behavioral2/files/0x000a000000023b9a-170.dat xmrig behavioral2/files/0x000a000000023b98-168.dat xmrig behavioral2/files/0x000a000000023b99-165.dat xmrig behavioral2/files/0x000a000000023b96-158.dat xmrig behavioral2/files/0x000a000000023b95-153.dat xmrig behavioral2/files/0x000a000000023b93-143.dat xmrig behavioral2/files/0x000a000000023b92-138.dat xmrig behavioral2/files/0x000a000000023b91-133.dat xmrig behavioral2/files/0x000a000000023b90-129.dat xmrig behavioral2/files/0x000a000000023b8f-122.dat xmrig behavioral2/files/0x000a000000023b8d-113.dat xmrig behavioral2/files/0x000a000000023b8c-108.dat xmrig behavioral2/files/0x000a000000023b8b-103.dat xmrig behavioral2/files/0x000a000000023b89-93.dat xmrig behavioral2/files/0x000a000000023b88-88.dat xmrig behavioral2/files/0x000a000000023b86-76.dat xmrig behavioral2/files/0x000a000000023b84-66.dat xmrig behavioral2/files/0x000a000000023b82-59.dat xmrig behavioral2/memory/3040-55-0x00007FF675AA0000-0x00007FF675DF4000-memory.dmp xmrig behavioral2/memory/4232-50-0x00007FF7AEE00000-0x00007FF7AF154000-memory.dmp xmrig behavioral2/files/0x0031000000023b80-44.dat xmrig behavioral2/memory/552-43-0x00007FF7D1C30000-0x00007FF7D1F84000-memory.dmp xmrig behavioral2/files/0x0031000000023b7f-41.dat xmrig behavioral2/files/0x000a000000023b7d-28.dat xmrig behavioral2/memory/4756-26-0x00007FF6107E0000-0x00007FF610B34000-memory.dmp xmrig behavioral2/memory/2608-21-0x00007FF765630000-0x00007FF765984000-memory.dmp xmrig behavioral2/memory/3376-20-0x00007FF713530000-0x00007FF713884000-memory.dmp xmrig behavioral2/memory/3668-566-0x00007FF722990000-0x00007FF722CE4000-memory.dmp xmrig behavioral2/memory/4752-567-0x00007FF636350000-0x00007FF6366A4000-memory.dmp xmrig behavioral2/memory/3860-565-0x00007FF789720000-0x00007FF789A74000-memory.dmp xmrig behavioral2/memory/4808-568-0x00007FF6507A0000-0x00007FF650AF4000-memory.dmp xmrig behavioral2/memory/3936-569-0x00007FF64A4C0000-0x00007FF64A814000-memory.dmp xmrig behavioral2/memory/4948-570-0x00007FF7E8FB0000-0x00007FF7E9304000-memory.dmp xmrig behavioral2/memory/2832-571-0x00007FF617980000-0x00007FF617CD4000-memory.dmp xmrig behavioral2/memory/4764-572-0x00007FF669630000-0x00007FF669984000-memory.dmp xmrig behavioral2/memory/2312-575-0x00007FF63AFD0000-0x00007FF63B324000-memory.dmp xmrig behavioral2/memory/2952-583-0x00007FF6A9570000-0x00007FF6A98C4000-memory.dmp xmrig behavioral2/memory/1768-582-0x00007FF6CBF80000-0x00007FF6CC2D4000-memory.dmp xmrig behavioral2/memory/3944-590-0x00007FF6823A0000-0x00007FF6826F4000-memory.dmp xmrig behavioral2/memory/4784-589-0x00007FF7C7370000-0x00007FF7C76C4000-memory.dmp xmrig behavioral2/memory/3536-603-0x00007FF6959D0000-0x00007FF695D24000-memory.dmp xmrig behavioral2/memory/1136-617-0x00007FF758860000-0x00007FF758BB4000-memory.dmp xmrig behavioral2/memory/4568-613-0x00007FF60F010000-0x00007FF60F364000-memory.dmp xmrig behavioral2/memory/5100-607-0x00007FF75A9A0000-0x00007FF75ACF4000-memory.dmp xmrig behavioral2/memory/636-598-0x00007FF6BC750000-0x00007FF6BCAA4000-memory.dmp xmrig behavioral2/memory/4892-625-0x00007FF76E920000-0x00007FF76EC74000-memory.dmp xmrig behavioral2/memory/5064-632-0x00007FF60BA30000-0x00007FF60BD84000-memory.dmp xmrig behavioral2/memory/980-595-0x00007FF6C7E60000-0x00007FF6C81B4000-memory.dmp xmrig behavioral2/memory/1924-1070-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp xmrig -
Executes dropped EXE 64 IoCs
pid Process 1392 BRSETID.exe 3376 Fgcpkwa.exe 4756 fDCqfjN.exe 2608 gAEGirM.exe 552 sQQvjjI.exe 4232 IIzkCtX.exe 1136 lqlruOr.exe 3040 sVtEHRw.exe 4892 cltCQiM.exe 400 TNkvuPM.exe 5064 bFKxMyG.exe 3860 IJGpFUS.exe 3668 TbWmjre.exe 4752 uyMcaLm.exe 4808 HADahpL.exe 3936 qhrcLLK.exe 4948 KdXYApM.exe 2832 FGhzjYD.exe 4764 ygkJaRH.exe 2312 qyJCkyH.exe 1768 nHufsKt.exe 2952 EQshivK.exe 4784 rnyUvwf.exe 3944 dmYVqBi.exe 980 xTshByG.exe 636 XSrAOct.exe 3536 HRQguze.exe 5100 sHgvbxT.exe 4568 BZGOqzD.exe 4160 joBRmwt.exe 2356 ESeuVtQ.exe 4768 UJqEtXK.exe 3880 mhDPSat.exe 4380 SxQeuLO.exe 4996 VtjIxKe.exe 3132 mkgfHka.exe 2432 QNqZQgn.exe 5008 nzHjimA.exe 3544 qGGzaZG.exe 4316 XNdPLHV.exe 1036 QfKCVEG.exe 920 KWPwwqb.exe 5036 CCrMLAl.exe 3592 rxxAKDX.exe 3388 sdYzDHX.exe 748 ybNkCQh.exe 4368 GHyEbaA.exe 4064 nwgtSZe.exe 1516 ZeQwzhX.exe 2820 nBqQfOx.exe 3152 iJkRMQq.exe 4148 vAKhuRv.exe 4492 xijJurb.exe 4296 hYcqinI.exe 3968 hIKSzme.exe 2280 Fvucomt.exe 4460 stOcsNC.exe 3328 AYkjGBN.exe 1080 eruaZHj.exe 3080 SOIJRhf.exe 3124 PGBfxyv.exe 3140 PBZaFgP.exe 2264 luCaCwj.exe 3048 rOKAPsB.exe -
resource yara_rule behavioral2/memory/1924-0-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp upx behavioral2/files/0x000b000000023b77-5.dat upx behavioral2/files/0x000a000000023b7c-9.dat upx behavioral2/files/0x000a000000023b7b-15.dat upx behavioral2/memory/1392-13-0x00007FF6D63C0000-0x00007FF6D6714000-memory.dmp upx behavioral2/files/0x0031000000023b81-38.dat upx behavioral2/files/0x000a000000023b7e-39.dat upx behavioral2/files/0x000a000000023b83-54.dat upx behavioral2/files/0x000a000000023b85-70.dat upx behavioral2/files/0x000a000000023b87-80.dat upx behavioral2/files/0x000a000000023b8a-90.dat upx behavioral2/files/0x000a000000023b8e-110.dat upx behavioral2/files/0x000a000000023b94-140.dat upx behavioral2/files/0x000a000000023b97-163.dat upx behavioral2/memory/400-564-0x00007FF605B10000-0x00007FF605E64000-memory.dmp upx behavioral2/files/0x000a000000023b9a-170.dat upx behavioral2/files/0x000a000000023b98-168.dat upx behavioral2/files/0x000a000000023b99-165.dat upx behavioral2/files/0x000a000000023b96-158.dat upx behavioral2/files/0x000a000000023b95-153.dat upx behavioral2/files/0x000a000000023b93-143.dat upx behavioral2/files/0x000a000000023b92-138.dat upx behavioral2/files/0x000a000000023b91-133.dat upx behavioral2/files/0x000a000000023b90-129.dat upx behavioral2/files/0x000a000000023b8f-122.dat upx behavioral2/files/0x000a000000023b8d-113.dat upx behavioral2/files/0x000a000000023b8c-108.dat upx behavioral2/files/0x000a000000023b8b-103.dat upx behavioral2/files/0x000a000000023b89-93.dat upx behavioral2/files/0x000a000000023b88-88.dat upx behavioral2/files/0x000a000000023b86-76.dat upx behavioral2/files/0x000a000000023b84-66.dat upx behavioral2/files/0x000a000000023b82-59.dat upx behavioral2/memory/3040-55-0x00007FF675AA0000-0x00007FF675DF4000-memory.dmp upx behavioral2/memory/4232-50-0x00007FF7AEE00000-0x00007FF7AF154000-memory.dmp upx behavioral2/files/0x0031000000023b80-44.dat upx behavioral2/memory/552-43-0x00007FF7D1C30000-0x00007FF7D1F84000-memory.dmp upx behavioral2/files/0x0031000000023b7f-41.dat upx behavioral2/files/0x000a000000023b7d-28.dat upx behavioral2/memory/4756-26-0x00007FF6107E0000-0x00007FF610B34000-memory.dmp upx behavioral2/memory/2608-21-0x00007FF765630000-0x00007FF765984000-memory.dmp upx behavioral2/memory/3376-20-0x00007FF713530000-0x00007FF713884000-memory.dmp upx behavioral2/memory/3668-566-0x00007FF722990000-0x00007FF722CE4000-memory.dmp upx behavioral2/memory/4752-567-0x00007FF636350000-0x00007FF6366A4000-memory.dmp upx behavioral2/memory/3860-565-0x00007FF789720000-0x00007FF789A74000-memory.dmp upx behavioral2/memory/4808-568-0x00007FF6507A0000-0x00007FF650AF4000-memory.dmp upx behavioral2/memory/3936-569-0x00007FF64A4C0000-0x00007FF64A814000-memory.dmp upx behavioral2/memory/4948-570-0x00007FF7E8FB0000-0x00007FF7E9304000-memory.dmp upx behavioral2/memory/2832-571-0x00007FF617980000-0x00007FF617CD4000-memory.dmp upx behavioral2/memory/4764-572-0x00007FF669630000-0x00007FF669984000-memory.dmp upx behavioral2/memory/2312-575-0x00007FF63AFD0000-0x00007FF63B324000-memory.dmp upx behavioral2/memory/2952-583-0x00007FF6A9570000-0x00007FF6A98C4000-memory.dmp upx behavioral2/memory/1768-582-0x00007FF6CBF80000-0x00007FF6CC2D4000-memory.dmp upx behavioral2/memory/3944-590-0x00007FF6823A0000-0x00007FF6826F4000-memory.dmp upx behavioral2/memory/4784-589-0x00007FF7C7370000-0x00007FF7C76C4000-memory.dmp upx behavioral2/memory/3536-603-0x00007FF6959D0000-0x00007FF695D24000-memory.dmp upx behavioral2/memory/1136-617-0x00007FF758860000-0x00007FF758BB4000-memory.dmp upx behavioral2/memory/4568-613-0x00007FF60F010000-0x00007FF60F364000-memory.dmp upx behavioral2/memory/5100-607-0x00007FF75A9A0000-0x00007FF75ACF4000-memory.dmp upx behavioral2/memory/636-598-0x00007FF6BC750000-0x00007FF6BCAA4000-memory.dmp upx behavioral2/memory/4892-625-0x00007FF76E920000-0x00007FF76EC74000-memory.dmp upx behavioral2/memory/5064-632-0x00007FF60BA30000-0x00007FF60BD84000-memory.dmp upx behavioral2/memory/980-595-0x00007FF6C7E60000-0x00007FF6C81B4000-memory.dmp upx behavioral2/memory/1924-1070-0x00007FF66C0E0000-0x00007FF66C434000-memory.dmp upx -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\System\nTIcxtn.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\xaGPZNW.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\NlDFazP.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\cGNDaGG.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\CFvxNRW.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\pHnaYCC.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\qhrcLLK.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\QDjNKos.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\LaxkXrD.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\qCXSWhp.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\owbGjhO.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\kOEquOt.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\BzGBPzK.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\BRSETID.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\GkKAxxa.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\nBqQfOx.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\eAiYKxX.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\UaAQypv.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\lqlruOr.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\YiEcfSJ.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\YbsSUxR.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\JrhdQlL.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\cltCQiM.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\FuzgbRd.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\ovvNYYM.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\csRKTLz.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\BHDbCJu.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\rcgwVLF.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\YRtSAGX.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\ybNkCQh.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\NXLuOqE.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\ZLWEElo.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\RgRjguW.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\kbXrqhx.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\queTcqK.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\UJqEtXK.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\MOOdeYQ.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\EVVxaUU.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\BlsJyuv.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\bzeuUok.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\QvCCaVw.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\acKJfBk.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\ODhVXad.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\FGhzjYD.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\IJGpFUS.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\BZGOqzD.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\JeTUaEx.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\gAEGirM.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\nmvuGfF.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\ZEAxrYw.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\LvYuIJT.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\pVamwrL.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\uokzKih.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\qafwuFV.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\sArZveM.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\WVoRXQO.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\TxRBhUu.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\CoFuwZc.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\PqWmZTk.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\ZeDXfas.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\EbpWcDB.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\VnFHvwU.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\chMuNOe.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe File created C:\Windows\System\LTBXTEQ.exe e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeLockMemoryPrivilege 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe Token: SeLockMemoryPrivilege 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1924 wrote to memory of 1392 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 85 PID 1924 wrote to memory of 1392 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 85 PID 1924 wrote to memory of 3376 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 86 PID 1924 wrote to memory of 3376 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 86 PID 1924 wrote to memory of 4756 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 87 PID 1924 wrote to memory of 4756 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 87 PID 1924 wrote to memory of 2608 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 88 PID 1924 wrote to memory of 2608 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 88 PID 1924 wrote to memory of 552 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 89 PID 1924 wrote to memory of 552 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 89 PID 1924 wrote to memory of 4232 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 90 PID 1924 wrote to memory of 4232 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 90 PID 1924 wrote to memory of 1136 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 91 PID 1924 wrote to memory of 1136 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 91 PID 1924 wrote to memory of 3040 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 92 PID 1924 wrote to memory of 3040 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 92 PID 1924 wrote to memory of 4892 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 93 PID 1924 wrote to memory of 4892 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 93 PID 1924 wrote to memory of 400 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 94 PID 1924 wrote to memory of 400 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 94 PID 1924 wrote to memory of 5064 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 95 PID 1924 wrote to memory of 5064 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 95 PID 1924 wrote to memory of 3860 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 96 PID 1924 wrote to memory of 3860 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 96 PID 1924 wrote to memory of 3668 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 97 PID 1924 wrote to memory of 3668 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 97 PID 1924 wrote to memory of 4752 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 98 PID 1924 wrote to memory of 4752 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 98 PID 1924 wrote to memory of 4808 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 99 PID 1924 wrote to memory of 4808 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 99 PID 1924 wrote to memory of 3936 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 100 PID 1924 wrote to memory of 3936 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 100 PID 1924 wrote to memory of 4948 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 101 PID 1924 wrote to memory of 4948 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 101 PID 1924 wrote to memory of 2832 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 102 PID 1924 wrote to memory of 2832 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 102 PID 1924 wrote to memory of 4764 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 103 PID 1924 wrote to memory of 4764 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 103 PID 1924 wrote to memory of 2312 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 104 PID 1924 wrote to memory of 2312 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 104 PID 1924 wrote to memory of 1768 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 105 PID 1924 wrote to memory of 1768 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 105 PID 1924 wrote to memory of 2952 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 106 PID 1924 wrote to memory of 2952 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 106 PID 1924 wrote to memory of 4784 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 107 PID 1924 wrote to memory of 4784 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 107 PID 1924 wrote to memory of 3944 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 108 PID 1924 wrote to memory of 3944 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 108 PID 1924 wrote to memory of 980 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 109 PID 1924 wrote to memory of 980 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 109 PID 1924 wrote to memory of 636 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 110 PID 1924 wrote to memory of 636 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 110 PID 1924 wrote to memory of 3536 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 111 PID 1924 wrote to memory of 3536 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 111 PID 1924 wrote to memory of 5100 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 112 PID 1924 wrote to memory of 5100 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 112 PID 1924 wrote to memory of 4568 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 113 PID 1924 wrote to memory of 4568 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 113 PID 1924 wrote to memory of 4160 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 114 PID 1924 wrote to memory of 4160 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 114 PID 1924 wrote to memory of 2356 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 115 PID 1924 wrote to memory of 2356 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 115 PID 1924 wrote to memory of 4768 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 116 PID 1924 wrote to memory of 4768 1924 e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe 116
Processes
-
C:\Users\Admin\AppData\Local\Temp\e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe"C:\Users\Admin\AppData\Local\Temp\e5aad7bec5ae6c97a3cdd5b446936b6a7abe42a4f31c9b4f335026c6bb25fee4.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\System\BRSETID.exeC:\Windows\System\BRSETID.exe2⤵
- Executes dropped EXE
PID:1392
-
-
C:\Windows\System\Fgcpkwa.exeC:\Windows\System\Fgcpkwa.exe2⤵
- Executes dropped EXE
PID:3376
-
-
C:\Windows\System\fDCqfjN.exeC:\Windows\System\fDCqfjN.exe2⤵
- Executes dropped EXE
PID:4756
-
-
C:\Windows\System\gAEGirM.exeC:\Windows\System\gAEGirM.exe2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Windows\System\sQQvjjI.exeC:\Windows\System\sQQvjjI.exe2⤵
- Executes dropped EXE
PID:552
-
-
C:\Windows\System\IIzkCtX.exeC:\Windows\System\IIzkCtX.exe2⤵
- Executes dropped EXE
PID:4232
-
-
C:\Windows\System\lqlruOr.exeC:\Windows\System\lqlruOr.exe2⤵
- Executes dropped EXE
PID:1136
-
-
C:\Windows\System\sVtEHRw.exeC:\Windows\System\sVtEHRw.exe2⤵
- Executes dropped EXE
PID:3040
-
-
C:\Windows\System\cltCQiM.exeC:\Windows\System\cltCQiM.exe2⤵
- Executes dropped EXE
PID:4892
-
-
C:\Windows\System\TNkvuPM.exeC:\Windows\System\TNkvuPM.exe2⤵
- Executes dropped EXE
PID:400
-
-
C:\Windows\System\bFKxMyG.exeC:\Windows\System\bFKxMyG.exe2⤵
- Executes dropped EXE
PID:5064
-
-
C:\Windows\System\IJGpFUS.exeC:\Windows\System\IJGpFUS.exe2⤵
- Executes dropped EXE
PID:3860
-
-
C:\Windows\System\TbWmjre.exeC:\Windows\System\TbWmjre.exe2⤵
- Executes dropped EXE
PID:3668
-
-
C:\Windows\System\uyMcaLm.exeC:\Windows\System\uyMcaLm.exe2⤵
- Executes dropped EXE
PID:4752
-
-
C:\Windows\System\HADahpL.exeC:\Windows\System\HADahpL.exe2⤵
- Executes dropped EXE
PID:4808
-
-
C:\Windows\System\qhrcLLK.exeC:\Windows\System\qhrcLLK.exe2⤵
- Executes dropped EXE
PID:3936
-
-
C:\Windows\System\KdXYApM.exeC:\Windows\System\KdXYApM.exe2⤵
- Executes dropped EXE
PID:4948
-
-
C:\Windows\System\FGhzjYD.exeC:\Windows\System\FGhzjYD.exe2⤵
- Executes dropped EXE
PID:2832
-
-
C:\Windows\System\ygkJaRH.exeC:\Windows\System\ygkJaRH.exe2⤵
- Executes dropped EXE
PID:4764
-
-
C:\Windows\System\qyJCkyH.exeC:\Windows\System\qyJCkyH.exe2⤵
- Executes dropped EXE
PID:2312
-
-
C:\Windows\System\nHufsKt.exeC:\Windows\System\nHufsKt.exe2⤵
- Executes dropped EXE
PID:1768
-
-
C:\Windows\System\EQshivK.exeC:\Windows\System\EQshivK.exe2⤵
- Executes dropped EXE
PID:2952
-
-
C:\Windows\System\rnyUvwf.exeC:\Windows\System\rnyUvwf.exe2⤵
- Executes dropped EXE
PID:4784
-
-
C:\Windows\System\dmYVqBi.exeC:\Windows\System\dmYVqBi.exe2⤵
- Executes dropped EXE
PID:3944
-
-
C:\Windows\System\xTshByG.exeC:\Windows\System\xTshByG.exe2⤵
- Executes dropped EXE
PID:980
-
-
C:\Windows\System\XSrAOct.exeC:\Windows\System\XSrAOct.exe2⤵
- Executes dropped EXE
PID:636
-
-
C:\Windows\System\HRQguze.exeC:\Windows\System\HRQguze.exe2⤵
- Executes dropped EXE
PID:3536
-
-
C:\Windows\System\sHgvbxT.exeC:\Windows\System\sHgvbxT.exe2⤵
- Executes dropped EXE
PID:5100
-
-
C:\Windows\System\BZGOqzD.exeC:\Windows\System\BZGOqzD.exe2⤵
- Executes dropped EXE
PID:4568
-
-
C:\Windows\System\joBRmwt.exeC:\Windows\System\joBRmwt.exe2⤵
- Executes dropped EXE
PID:4160
-
-
C:\Windows\System\ESeuVtQ.exeC:\Windows\System\ESeuVtQ.exe2⤵
- Executes dropped EXE
PID:2356
-
-
C:\Windows\System\UJqEtXK.exeC:\Windows\System\UJqEtXK.exe2⤵
- Executes dropped EXE
PID:4768
-
-
C:\Windows\System\mhDPSat.exeC:\Windows\System\mhDPSat.exe2⤵
- Executes dropped EXE
PID:3880
-
-
C:\Windows\System\SxQeuLO.exeC:\Windows\System\SxQeuLO.exe2⤵
- Executes dropped EXE
PID:4380
-
-
C:\Windows\System\VtjIxKe.exeC:\Windows\System\VtjIxKe.exe2⤵
- Executes dropped EXE
PID:4996
-
-
C:\Windows\System\mkgfHka.exeC:\Windows\System\mkgfHka.exe2⤵
- Executes dropped EXE
PID:3132
-
-
C:\Windows\System\QNqZQgn.exeC:\Windows\System\QNqZQgn.exe2⤵
- Executes dropped EXE
PID:2432
-
-
C:\Windows\System\nzHjimA.exeC:\Windows\System\nzHjimA.exe2⤵
- Executes dropped EXE
PID:5008
-
-
C:\Windows\System\qGGzaZG.exeC:\Windows\System\qGGzaZG.exe2⤵
- Executes dropped EXE
PID:3544
-
-
C:\Windows\System\XNdPLHV.exeC:\Windows\System\XNdPLHV.exe2⤵
- Executes dropped EXE
PID:4316
-
-
C:\Windows\System\QfKCVEG.exeC:\Windows\System\QfKCVEG.exe2⤵
- Executes dropped EXE
PID:1036
-
-
C:\Windows\System\KWPwwqb.exeC:\Windows\System\KWPwwqb.exe2⤵
- Executes dropped EXE
PID:920
-
-
C:\Windows\System\CCrMLAl.exeC:\Windows\System\CCrMLAl.exe2⤵
- Executes dropped EXE
PID:5036
-
-
C:\Windows\System\rxxAKDX.exeC:\Windows\System\rxxAKDX.exe2⤵
- Executes dropped EXE
PID:3592
-
-
C:\Windows\System\sdYzDHX.exeC:\Windows\System\sdYzDHX.exe2⤵
- Executes dropped EXE
PID:3388
-
-
C:\Windows\System\ybNkCQh.exeC:\Windows\System\ybNkCQh.exe2⤵
- Executes dropped EXE
PID:748
-
-
C:\Windows\System\GHyEbaA.exeC:\Windows\System\GHyEbaA.exe2⤵
- Executes dropped EXE
PID:4368
-
-
C:\Windows\System\nwgtSZe.exeC:\Windows\System\nwgtSZe.exe2⤵
- Executes dropped EXE
PID:4064
-
-
C:\Windows\System\ZeQwzhX.exeC:\Windows\System\ZeQwzhX.exe2⤵
- Executes dropped EXE
PID:1516
-
-
C:\Windows\System\nBqQfOx.exeC:\Windows\System\nBqQfOx.exe2⤵
- Executes dropped EXE
PID:2820
-
-
C:\Windows\System\iJkRMQq.exeC:\Windows\System\iJkRMQq.exe2⤵
- Executes dropped EXE
PID:3152
-
-
C:\Windows\System\vAKhuRv.exeC:\Windows\System\vAKhuRv.exe2⤵
- Executes dropped EXE
PID:4148
-
-
C:\Windows\System\xijJurb.exeC:\Windows\System\xijJurb.exe2⤵
- Executes dropped EXE
PID:4492
-
-
C:\Windows\System\hYcqinI.exeC:\Windows\System\hYcqinI.exe2⤵
- Executes dropped EXE
PID:4296
-
-
C:\Windows\System\hIKSzme.exeC:\Windows\System\hIKSzme.exe2⤵
- Executes dropped EXE
PID:3968
-
-
C:\Windows\System\Fvucomt.exeC:\Windows\System\Fvucomt.exe2⤵
- Executes dropped EXE
PID:2280
-
-
C:\Windows\System\stOcsNC.exeC:\Windows\System\stOcsNC.exe2⤵
- Executes dropped EXE
PID:4460
-
-
C:\Windows\System\AYkjGBN.exeC:\Windows\System\AYkjGBN.exe2⤵
- Executes dropped EXE
PID:3328
-
-
C:\Windows\System\eruaZHj.exeC:\Windows\System\eruaZHj.exe2⤵
- Executes dropped EXE
PID:1080
-
-
C:\Windows\System\SOIJRhf.exeC:\Windows\System\SOIJRhf.exe2⤵
- Executes dropped EXE
PID:3080
-
-
C:\Windows\System\PGBfxyv.exeC:\Windows\System\PGBfxyv.exe2⤵
- Executes dropped EXE
PID:3124
-
-
C:\Windows\System\PBZaFgP.exeC:\Windows\System\PBZaFgP.exe2⤵
- Executes dropped EXE
PID:3140
-
-
C:\Windows\System\luCaCwj.exeC:\Windows\System\luCaCwj.exe2⤵
- Executes dropped EXE
PID:2264
-
-
C:\Windows\System\rOKAPsB.exeC:\Windows\System\rOKAPsB.exe2⤵
- Executes dropped EXE
PID:3048
-
-
C:\Windows\System\AIKRHyH.exeC:\Windows\System\AIKRHyH.exe2⤵PID:1388
-
-
C:\Windows\System\JjSoeKv.exeC:\Windows\System\JjSoeKv.exe2⤵PID:4804
-
-
C:\Windows\System\hskEWgq.exeC:\Windows\System\hskEWgq.exe2⤵PID:1096
-
-
C:\Windows\System\urCoZpM.exeC:\Windows\System\urCoZpM.exe2⤵PID:4812
-
-
C:\Windows\System\WTyTjde.exeC:\Windows\System\WTyTjde.exe2⤵PID:2752
-
-
C:\Windows\System\saxqfZh.exeC:\Windows\System\saxqfZh.exe2⤵PID:3060
-
-
C:\Windows\System\kDkOMIE.exeC:\Windows\System\kDkOMIE.exe2⤵PID:3580
-
-
C:\Windows\System\TMvSQih.exeC:\Windows\System\TMvSQih.exe2⤵PID:5072
-
-
C:\Windows\System\vFmpuNl.exeC:\Windows\System\vFmpuNl.exe2⤵PID:1504
-
-
C:\Windows\System\JtrnJOa.exeC:\Windows\System\JtrnJOa.exe2⤵PID:3112
-
-
C:\Windows\System\OzfQcgC.exeC:\Windows\System\OzfQcgC.exe2⤵PID:4520
-
-
C:\Windows\System\LLyVgzH.exeC:\Windows\System\LLyVgzH.exe2⤵PID:2984
-
-
C:\Windows\System\shWuVrF.exeC:\Windows\System\shWuVrF.exe2⤵PID:5148
-
-
C:\Windows\System\IDJcVDU.exeC:\Windows\System\IDJcVDU.exe2⤵PID:5176
-
-
C:\Windows\System\hzpwkOn.exeC:\Windows\System\hzpwkOn.exe2⤵PID:5204
-
-
C:\Windows\System\XeyscoP.exeC:\Windows\System\XeyscoP.exe2⤵PID:5232
-
-
C:\Windows\System\nAjKzFo.exeC:\Windows\System\nAjKzFo.exe2⤵PID:5260
-
-
C:\Windows\System\ALTxoLJ.exeC:\Windows\System\ALTxoLJ.exe2⤵PID:5292
-
-
C:\Windows\System\dqYxXJL.exeC:\Windows\System\dqYxXJL.exe2⤵PID:5320
-
-
C:\Windows\System\sDlqpIF.exeC:\Windows\System\sDlqpIF.exe2⤵PID:5344
-
-
C:\Windows\System\LvYuIJT.exeC:\Windows\System\LvYuIJT.exe2⤵PID:5376
-
-
C:\Windows\System\uuBEimw.exeC:\Windows\System\uuBEimw.exe2⤵PID:5404
-
-
C:\Windows\System\TNiElqZ.exeC:\Windows\System\TNiElqZ.exe2⤵PID:5428
-
-
C:\Windows\System\QDjNKos.exeC:\Windows\System\QDjNKos.exe2⤵PID:5456
-
-
C:\Windows\System\zwVVHtI.exeC:\Windows\System\zwVVHtI.exe2⤵PID:5484
-
-
C:\Windows\System\myfbpGh.exeC:\Windows\System\myfbpGh.exe2⤵PID:5512
-
-
C:\Windows\System\VnFHvwU.exeC:\Windows\System\VnFHvwU.exe2⤵PID:5540
-
-
C:\Windows\System\LaxkXrD.exeC:\Windows\System\LaxkXrD.exe2⤵PID:5568
-
-
C:\Windows\System\ZOCdzbA.exeC:\Windows\System\ZOCdzbA.exe2⤵PID:5600
-
-
C:\Windows\System\NJzOxUU.exeC:\Windows\System\NJzOxUU.exe2⤵PID:5624
-
-
C:\Windows\System\AZQJCFd.exeC:\Windows\System\AZQJCFd.exe2⤵PID:5652
-
-
C:\Windows\System\TfYqIIn.exeC:\Windows\System\TfYqIIn.exe2⤵PID:5680
-
-
C:\Windows\System\QDgqKvQ.exeC:\Windows\System\QDgqKvQ.exe2⤵PID:5712
-
-
C:\Windows\System\nTIcxtn.exeC:\Windows\System\nTIcxtn.exe2⤵PID:5736
-
-
C:\Windows\System\chMuNOe.exeC:\Windows\System\chMuNOe.exe2⤵PID:5764
-
-
C:\Windows\System\HIvAixw.exeC:\Windows\System\HIvAixw.exe2⤵PID:5792
-
-
C:\Windows\System\AdxXAFX.exeC:\Windows\System\AdxXAFX.exe2⤵PID:5820
-
-
C:\Windows\System\GjGpzJZ.exeC:\Windows\System\GjGpzJZ.exe2⤵PID:5848
-
-
C:\Windows\System\LTBXTEQ.exeC:\Windows\System\LTBXTEQ.exe2⤵PID:5876
-
-
C:\Windows\System\XSWQZMy.exeC:\Windows\System\XSWQZMy.exe2⤵PID:5904
-
-
C:\Windows\System\MOOdeYQ.exeC:\Windows\System\MOOdeYQ.exe2⤵PID:5932
-
-
C:\Windows\System\DejJVMv.exeC:\Windows\System\DejJVMv.exe2⤵PID:5956
-
-
C:\Windows\System\WVoRXQO.exeC:\Windows\System\WVoRXQO.exe2⤵PID:5988
-
-
C:\Windows\System\bflAbLm.exeC:\Windows\System\bflAbLm.exe2⤵PID:6016
-
-
C:\Windows\System\FfPrlOr.exeC:\Windows\System\FfPrlOr.exe2⤵PID:6044
-
-
C:\Windows\System\dPGUvFc.exeC:\Windows\System\dPGUvFc.exe2⤵PID:6072
-
-
C:\Windows\System\PsBhleT.exeC:\Windows\System\PsBhleT.exe2⤵PID:6100
-
-
C:\Windows\System\qCXSWhp.exeC:\Windows\System\qCXSWhp.exe2⤵PID:6128
-
-
C:\Windows\System\eAiYKxX.exeC:\Windows\System\eAiYKxX.exe2⤵PID:4556
-
-
C:\Windows\System\KhTFqJH.exeC:\Windows\System\KhTFqJH.exe2⤵PID:376
-
-
C:\Windows\System\JeTUaEx.exeC:\Windows\System\JeTUaEx.exe2⤵PID:4332
-
-
C:\Windows\System\NfgEHnY.exeC:\Windows\System\NfgEHnY.exe2⤵PID:1788
-
-
C:\Windows\System\XPCFtQT.exeC:\Windows\System\XPCFtQT.exe2⤵PID:1312
-
-
C:\Windows\System\jQYTfAB.exeC:\Windows\System\jQYTfAB.exe2⤵PID:5164
-
-
C:\Windows\System\SqmPHcZ.exeC:\Windows\System\SqmPHcZ.exe2⤵PID:5224
-
-
C:\Windows\System\AQLASBD.exeC:\Windows\System\AQLASBD.exe2⤵PID:5440
-
-
C:\Windows\System\AFLlgth.exeC:\Windows\System\AFLlgth.exe2⤵PID:5472
-
-
C:\Windows\System\hcJghtj.exeC:\Windows\System\hcJghtj.exe2⤵PID:5504
-
-
C:\Windows\System\rxNKyNm.exeC:\Windows\System\rxNKyNm.exe2⤵PID:5560
-
-
C:\Windows\System\WxBazQj.exeC:\Windows\System\WxBazQj.exe2⤵PID:5612
-
-
C:\Windows\System\HKMyHPr.exeC:\Windows\System\HKMyHPr.exe2⤵PID:5692
-
-
C:\Windows\System\DSTgmkP.exeC:\Windows\System\DSTgmkP.exe2⤵PID:5748
-
-
C:\Windows\System\VXdXsPW.exeC:\Windows\System\VXdXsPW.exe2⤵PID:5780
-
-
C:\Windows\System\ElYoSvU.exeC:\Windows\System\ElYoSvU.exe2⤵PID:5860
-
-
C:\Windows\System\qAyLHOt.exeC:\Windows\System\qAyLHOt.exe2⤵PID:5896
-
-
C:\Windows\System\SshxjDA.exeC:\Windows\System\SshxjDA.exe2⤵PID:5972
-
-
C:\Windows\System\owbGjhO.exeC:\Windows\System\owbGjhO.exe2⤵PID:620
-
-
C:\Windows\System\WVcbRyN.exeC:\Windows\System\WVcbRyN.exe2⤵PID:6084
-
-
C:\Windows\System\ogSTGgv.exeC:\Windows\System\ogSTGgv.exe2⤵PID:6140
-
-
C:\Windows\System\SXCaVvp.exeC:\Windows\System\SXCaVvp.exe2⤵PID:2036
-
-
C:\Windows\System\zwLmPsH.exeC:\Windows\System\zwLmPsH.exe2⤵PID:1592
-
-
C:\Windows\System\XAiDTUp.exeC:\Windows\System\XAiDTUp.exe2⤵PID:5140
-
-
C:\Windows\System\kICJwiP.exeC:\Windows\System\kICJwiP.exe2⤵PID:5360
-
-
C:\Windows\System\NXLuOqE.exeC:\Windows\System\NXLuOqE.exe2⤵PID:1064
-
-
C:\Windows\System\EbpWcDB.exeC:\Windows\System\EbpWcDB.exe2⤵PID:5076
-
-
C:\Windows\System\pVamwrL.exeC:\Windows\System\pVamwrL.exe2⤵PID:5776
-
-
C:\Windows\System\BRvVNOd.exeC:\Windows\System\BRvVNOd.exe2⤵PID:5892
-
-
C:\Windows\System\ZLWEElo.exeC:\Windows\System\ZLWEElo.exe2⤵PID:6008
-
-
C:\Windows\System\FuzgbRd.exeC:\Windows\System\FuzgbRd.exe2⤵PID:4792
-
-
C:\Windows\System\ZlmkwCI.exeC:\Windows\System\ZlmkwCI.exe2⤵PID:3680
-
-
C:\Windows\System\QUKYyYi.exeC:\Windows\System\QUKYyYi.exe2⤵PID:5276
-
-
C:\Windows\System\EnjJFNH.exeC:\Windows\System\EnjJFNH.exe2⤵PID:6172
-
-
C:\Windows\System\xaGPZNW.exeC:\Windows\System\xaGPZNW.exe2⤵PID:6200
-
-
C:\Windows\System\dIwgOlE.exeC:\Windows\System\dIwgOlE.exe2⤵PID:6228
-
-
C:\Windows\System\XlkTNIM.exeC:\Windows\System\XlkTNIM.exe2⤵PID:6256
-
-
C:\Windows\System\bLLMvqg.exeC:\Windows\System\bLLMvqg.exe2⤵PID:6284
-
-
C:\Windows\System\pnalYxx.exeC:\Windows\System\pnalYxx.exe2⤵PID:6312
-
-
C:\Windows\System\qCjlxOV.exeC:\Windows\System\qCjlxOV.exe2⤵PID:6336
-
-
C:\Windows\System\hgabyll.exeC:\Windows\System\hgabyll.exe2⤵PID:6364
-
-
C:\Windows\System\hfZajYl.exeC:\Windows\System\hfZajYl.exe2⤵PID:6396
-
-
C:\Windows\System\cSdtTww.exeC:\Windows\System\cSdtTww.exe2⤵PID:6424
-
-
C:\Windows\System\EVVxaUU.exeC:\Windows\System\EVVxaUU.exe2⤵PID:6448
-
-
C:\Windows\System\NxMPPIs.exeC:\Windows\System\NxMPPIs.exe2⤵PID:6476
-
-
C:\Windows\System\yOFYMhJ.exeC:\Windows\System\yOFYMhJ.exe2⤵PID:6504
-
-
C:\Windows\System\zElZVmz.exeC:\Windows\System\zElZVmz.exe2⤵PID:6536
-
-
C:\Windows\System\LsbLSuE.exeC:\Windows\System\LsbLSuE.exe2⤵PID:6560
-
-
C:\Windows\System\lsqPCnJ.exeC:\Windows\System\lsqPCnJ.exe2⤵PID:6592
-
-
C:\Windows\System\AKyJLKI.exeC:\Windows\System\AKyJLKI.exe2⤵PID:6620
-
-
C:\Windows\System\fESQPHe.exeC:\Windows\System\fESQPHe.exe2⤵PID:6644
-
-
C:\Windows\System\rZfOqIc.exeC:\Windows\System\rZfOqIc.exe2⤵PID:6676
-
-
C:\Windows\System\JXSsuai.exeC:\Windows\System\JXSsuai.exe2⤵PID:6704
-
-
C:\Windows\System\jyxLhWI.exeC:\Windows\System\jyxLhWI.exe2⤵PID:6812
-
-
C:\Windows\System\TQjXYZL.exeC:\Windows\System\TQjXYZL.exe2⤵PID:6852
-
-
C:\Windows\System\vuUxWiW.exeC:\Windows\System\vuUxWiW.exe2⤵PID:6868
-
-
C:\Windows\System\TOuWybn.exeC:\Windows\System\TOuWybn.exe2⤵PID:6908
-
-
C:\Windows\System\BlsJyuv.exeC:\Windows\System\BlsJyuv.exe2⤵PID:6952
-
-
C:\Windows\System\nCnBGda.exeC:\Windows\System\nCnBGda.exe2⤵PID:6968
-
-
C:\Windows\System\TxRBhUu.exeC:\Windows\System\TxRBhUu.exe2⤵PID:6988
-
-
C:\Windows\System\HSzqHmy.exeC:\Windows\System\HSzqHmy.exe2⤵PID:7016
-
-
C:\Windows\System\ovvNYYM.exeC:\Windows\System\ovvNYYM.exe2⤵PID:7060
-
-
C:\Windows\System\DJNgRQI.exeC:\Windows\System\DJNgRQI.exe2⤵PID:7084
-
-
C:\Windows\System\aXETZAM.exeC:\Windows\System\aXETZAM.exe2⤵PID:7120
-
-
C:\Windows\System\NlDFazP.exeC:\Windows\System\NlDFazP.exe2⤵PID:5468
-
-
C:\Windows\System\PoRBsEB.exeC:\Windows\System\PoRBsEB.exe2⤵PID:5556
-
-
C:\Windows\System\apgaGsk.exeC:\Windows\System\apgaGsk.exe2⤵PID:852
-
-
C:\Windows\System\NFREMCa.exeC:\Windows\System\NFREMCa.exe2⤵PID:5252
-
-
C:\Windows\System\fiGYWxu.exeC:\Windows\System\fiGYWxu.exe2⤵PID:5308
-
-
C:\Windows\System\bzeuUok.exeC:\Windows\System\bzeuUok.exe2⤵PID:4348
-
-
C:\Windows\System\GkKAxxa.exeC:\Windows\System\GkKAxxa.exe2⤵PID:6324
-
-
C:\Windows\System\fKefmsg.exeC:\Windows\System\fKefmsg.exe2⤵PID:5096
-
-
C:\Windows\System\qSsnlza.exeC:\Windows\System\qSsnlza.exe2⤵PID:6408
-
-
C:\Windows\System\naPoSBR.exeC:\Windows\System\naPoSBR.exe2⤵PID:4420
-
-
C:\Windows\System\wuJmdYY.exeC:\Windows\System\wuJmdYY.exe2⤵PID:6472
-
-
C:\Windows\System\pYxhxmB.exeC:\Windows\System\pYxhxmB.exe2⤵PID:6528
-
-
C:\Windows\System\cTZMgjf.exeC:\Windows\System\cTZMgjf.exe2⤵PID:2584
-
-
C:\Windows\System\doJeMjN.exeC:\Windows\System\doJeMjN.exe2⤵PID:4308
-
-
C:\Windows\System\csRKTLz.exeC:\Windows\System\csRKTLz.exe2⤵PID:6660
-
-
C:\Windows\System\ubIHjLT.exeC:\Windows\System\ubIHjLT.exe2⤵PID:2564
-
-
C:\Windows\System\CoFuwZc.exeC:\Windows\System\CoFuwZc.exe2⤵PID:3948
-
-
C:\Windows\System\QvCCaVw.exeC:\Windows\System\QvCCaVw.exe2⤵PID:6740
-
-
C:\Windows\System\cuIjjia.exeC:\Windows\System\cuIjjia.exe2⤵PID:2016
-
-
C:\Windows\System\Boxnlsr.exeC:\Windows\System\Boxnlsr.exe2⤵PID:6760
-
-
C:\Windows\System\PfYKUrR.exeC:\Windows\System\PfYKUrR.exe2⤵PID:3320
-
-
C:\Windows\System\ONTPgnC.exeC:\Windows\System\ONTPgnC.exe2⤵PID:6804
-
-
C:\Windows\System\gupPSSD.exeC:\Windows\System\gupPSSD.exe2⤵PID:6860
-
-
C:\Windows\System\jvfuBOV.exeC:\Windows\System\jvfuBOV.exe2⤵PID:6960
-
-
C:\Windows\System\RkCyLqo.exeC:\Windows\System\RkCyLqo.exe2⤵PID:7108
-
-
C:\Windows\System\cGNDaGG.exeC:\Windows\System\cGNDaGG.exe2⤵PID:7076
-
-
C:\Windows\System\UaAQypv.exeC:\Windows\System\UaAQypv.exe2⤵PID:536
-
-
C:\Windows\System\JXtboaA.exeC:\Windows\System\JXtboaA.exe2⤵PID:3868
-
-
C:\Windows\System\DwHIsuQ.exeC:\Windows\System\DwHIsuQ.exe2⤵PID:6192
-
-
C:\Windows\System\drjuMpB.exeC:\Windows\System\drjuMpB.exe2⤵PID:6876
-
-
C:\Windows\System\sdwxziU.exeC:\Windows\System\sdwxziU.exe2⤵PID:6116
-
-
C:\Windows\System\nmvuGfF.exeC:\Windows\System\nmvuGfF.exe2⤵PID:2284
-
-
C:\Windows\System\nAlsKBi.exeC:\Windows\System\nAlsKBi.exe2⤵PID:6388
-
-
C:\Windows\System\ZEAxrYw.exeC:\Windows\System\ZEAxrYw.exe2⤵PID:884
-
-
C:\Windows\System\acKJfBk.exeC:\Windows\System\acKJfBk.exe2⤵PID:2664
-
-
C:\Windows\System\JITeXQS.exeC:\Windows\System\JITeXQS.exe2⤵PID:804
-
-
C:\Windows\System\dGlMqzh.exeC:\Windows\System\dGlMqzh.exe2⤵PID:1424
-
-
C:\Windows\System\CFvxNRW.exeC:\Windows\System\CFvxNRW.exe2⤵PID:6668
-
-
C:\Windows\System\BCyoUbT.exeC:\Windows\System\BCyoUbT.exe2⤵PID:4172
-
-
C:\Windows\System\irssiVS.exeC:\Windows\System\irssiVS.exe2⤵PID:4292
-
-
C:\Windows\System\NFzJRoa.exeC:\Windows\System\NFzJRoa.exe2⤵PID:6948
-
-
C:\Windows\System\FqYDjec.exeC:\Windows\System\FqYDjec.exe2⤵PID:5948
-
-
C:\Windows\System\QIqyaBx.exeC:\Windows\System\QIqyaBx.exe2⤵PID:7068
-
-
C:\Windows\System\AgisnaS.exeC:\Windows\System\AgisnaS.exe2⤵PID:6464
-
-
C:\Windows\System\eqEIipc.exeC:\Windows\System\eqEIipc.exe2⤵PID:3240
-
-
C:\Windows\System\dfOjURk.exeC:\Windows\System\dfOjURk.exe2⤵PID:388
-
-
C:\Windows\System\pHnaYCC.exeC:\Windows\System\pHnaYCC.exe2⤵PID:692
-
-
C:\Windows\System\vDMPvLR.exeC:\Windows\System\vDMPvLR.exe2⤵PID:6216
-
-
C:\Windows\System\pyqdfYX.exeC:\Windows\System\pyqdfYX.exe2⤵PID:6552
-
-
C:\Windows\System\qUWdHQs.exeC:\Windows\System\qUWdHQs.exe2⤵PID:1420
-
-
C:\Windows\System\PhCkhEi.exeC:\Windows\System\PhCkhEi.exe2⤵PID:7104
-
-
C:\Windows\System\pGFhXVC.exeC:\Windows\System\pGFhXVC.exe2⤵PID:6996
-
-
C:\Windows\System\LHBNEwy.exeC:\Windows\System\LHBNEwy.exe2⤵PID:7196
-
-
C:\Windows\System\DmMTIpE.exeC:\Windows\System\DmMTIpE.exe2⤵PID:7220
-
-
C:\Windows\System\JRWhmYw.exeC:\Windows\System\JRWhmYw.exe2⤵PID:7248
-
-
C:\Windows\System\HwYIZkW.exeC:\Windows\System\HwYIZkW.exe2⤵PID:7276
-
-
C:\Windows\System\VmyzAzs.exeC:\Windows\System\VmyzAzs.exe2⤵PID:7308
-
-
C:\Windows\System\rCTZlIu.exeC:\Windows\System\rCTZlIu.exe2⤵PID:7348
-
-
C:\Windows\System\pGscPVT.exeC:\Windows\System\pGscPVT.exe2⤵PID:7376
-
-
C:\Windows\System\YLoocos.exeC:\Windows\System\YLoocos.exe2⤵PID:7408
-
-
C:\Windows\System\pnCMTuF.exeC:\Windows\System\pnCMTuF.exe2⤵PID:7440
-
-
C:\Windows\System\hPbcehm.exeC:\Windows\System\hPbcehm.exe2⤵PID:7464
-
-
C:\Windows\System\mmoblwl.exeC:\Windows\System\mmoblwl.exe2⤵PID:7488
-
-
C:\Windows\System\fZnIOQz.exeC:\Windows\System\fZnIOQz.exe2⤵PID:7504
-
-
C:\Windows\System\UbcDGnK.exeC:\Windows\System\UbcDGnK.exe2⤵PID:7544
-
-
C:\Windows\System\IodUkKS.exeC:\Windows\System\IodUkKS.exe2⤵PID:7572
-
-
C:\Windows\System\HHCXNYP.exeC:\Windows\System\HHCXNYP.exe2⤵PID:7600
-
-
C:\Windows\System\cwaiiIG.exeC:\Windows\System\cwaiiIG.exe2⤵PID:7640
-
-
C:\Windows\System\uokzKih.exeC:\Windows\System\uokzKih.exe2⤵PID:7660
-
-
C:\Windows\System\dLJaOVN.exeC:\Windows\System\dLJaOVN.exe2⤵PID:7684
-
-
C:\Windows\System\oPNDnjY.exeC:\Windows\System\oPNDnjY.exe2⤵PID:7716
-
-
C:\Windows\System\PqWmZTk.exeC:\Windows\System\PqWmZTk.exe2⤵PID:7752
-
-
C:\Windows\System\kOEquOt.exeC:\Windows\System\kOEquOt.exe2⤵PID:7772
-
-
C:\Windows\System\BHDbCJu.exeC:\Windows\System\BHDbCJu.exe2⤵PID:7800
-
-
C:\Windows\System\mtzlTvG.exeC:\Windows\System\mtzlTvG.exe2⤵PID:7824
-
-
C:\Windows\System\ynNgQpk.exeC:\Windows\System\ynNgQpk.exe2⤵PID:7856
-
-
C:\Windows\System\NDcNEEP.exeC:\Windows\System\NDcNEEP.exe2⤵PID:7884
-
-
C:\Windows\System\yZmuanZ.exeC:\Windows\System\yZmuanZ.exe2⤵PID:7908
-
-
C:\Windows\System\Jdvuead.exeC:\Windows\System\Jdvuead.exe2⤵PID:7952
-
-
C:\Windows\System\BzGBPzK.exeC:\Windows\System\BzGBPzK.exe2⤵PID:7972
-
-
C:\Windows\System\ZUnbZVJ.exeC:\Windows\System\ZUnbZVJ.exe2⤵PID:8008
-
-
C:\Windows\System\moZqQbM.exeC:\Windows\System\moZqQbM.exe2⤵PID:8036
-
-
C:\Windows\System\oprflbl.exeC:\Windows\System\oprflbl.exe2⤵PID:8052
-
-
C:\Windows\System\XHBBSgE.exeC:\Windows\System\XHBBSgE.exe2⤵PID:8084
-
-
C:\Windows\System\rcgwVLF.exeC:\Windows\System\rcgwVLF.exe2⤵PID:8120
-
-
C:\Windows\System\mSbmjJF.exeC:\Windows\System\mSbmjJF.exe2⤵PID:8148
-
-
C:\Windows\System\oHAhGih.exeC:\Windows\System\oHAhGih.exe2⤵PID:8176
-
-
C:\Windows\System\wMOtigl.exeC:\Windows\System\wMOtigl.exe2⤵PID:7176
-
-
C:\Windows\System\ErBZbXO.exeC:\Windows\System\ErBZbXO.exe2⤵PID:7240
-
-
C:\Windows\System\pkhAICj.exeC:\Windows\System\pkhAICj.exe2⤵PID:7328
-
-
C:\Windows\System\AeFFmcB.exeC:\Windows\System\AeFFmcB.exe2⤵PID:7368
-
-
C:\Windows\System\cNwKFLv.exeC:\Windows\System\cNwKFLv.exe2⤵PID:7428
-
-
C:\Windows\System\KcwBNmu.exeC:\Windows\System\KcwBNmu.exe2⤵PID:7496
-
-
C:\Windows\System\rcDtYXA.exeC:\Windows\System\rcDtYXA.exe2⤵PID:7552
-
-
C:\Windows\System\iMhfHiN.exeC:\Windows\System\iMhfHiN.exe2⤵PID:7612
-
-
C:\Windows\System\qafwuFV.exeC:\Windows\System\qafwuFV.exe2⤵PID:7708
-
-
C:\Windows\System\sgsACIn.exeC:\Windows\System\sgsACIn.exe2⤵PID:7736
-
-
C:\Windows\System\TgXLdXx.exeC:\Windows\System\TgXLdXx.exe2⤵PID:7796
-
-
C:\Windows\System\IdXurFv.exeC:\Windows\System\IdXurFv.exe2⤵PID:7880
-
-
C:\Windows\System\HxxWhNA.exeC:\Windows\System\HxxWhNA.exe2⤵PID:7924
-
-
C:\Windows\System\bwgspTK.exeC:\Windows\System\bwgspTK.exe2⤵PID:7980
-
-
C:\Windows\System\YiEcfSJ.exeC:\Windows\System\YiEcfSJ.exe2⤵PID:8032
-
-
C:\Windows\System\RgRjguW.exeC:\Windows\System\RgRjguW.exe2⤵PID:8104
-
-
C:\Windows\System\KnQpTAz.exeC:\Windows\System\KnQpTAz.exe2⤵PID:8160
-
-
C:\Windows\System\LyfxxBO.exeC:\Windows\System\LyfxxBO.exe2⤵PID:872
-
-
C:\Windows\System\CYBUOQT.exeC:\Windows\System\CYBUOQT.exe2⤵PID:7344
-
-
C:\Windows\System\IgZGbqB.exeC:\Windows\System\IgZGbqB.exe2⤵PID:7400
-
-
C:\Windows\System\rXhVYmT.exeC:\Windows\System\rXhVYmT.exe2⤵PID:7628
-
-
C:\Windows\System\ElVxTSQ.exeC:\Windows\System\ElVxTSQ.exe2⤵PID:7808
-
-
C:\Windows\System\nFPwZPw.exeC:\Windows\System\nFPwZPw.exe2⤵PID:7896
-
-
C:\Windows\System\GmjknQD.exeC:\Windows\System\GmjknQD.exe2⤵PID:8072
-
-
C:\Windows\System\kbXrqhx.exeC:\Windows\System\kbXrqhx.exe2⤵PID:7260
-
-
C:\Windows\System\TEPgBoz.exeC:\Windows\System\TEPgBoz.exe2⤵PID:3620
-
-
C:\Windows\System\sArZveM.exeC:\Windows\System\sArZveM.exe2⤵PID:7932
-
-
C:\Windows\System\PkwoAJl.exeC:\Windows\System\PkwoAJl.exe2⤵PID:8168
-
-
C:\Windows\System\uXkpkNt.exeC:\Windows\System\uXkpkNt.exe2⤵PID:8196
-
-
C:\Windows\System\BlVEzpA.exeC:\Windows\System\BlVEzpA.exe2⤵PID:8220
-
-
C:\Windows\System\queTcqK.exeC:\Windows\System\queTcqK.exe2⤵PID:8296
-
-
C:\Windows\System\KjkfQZb.exeC:\Windows\System\KjkfQZb.exe2⤵PID:8324
-
-
C:\Windows\System\ksOfbyt.exeC:\Windows\System\ksOfbyt.exe2⤵PID:8348
-
-
C:\Windows\System\pJhiGmj.exeC:\Windows\System\pJhiGmj.exe2⤵PID:8380
-
-
C:\Windows\System\OVjjrup.exeC:\Windows\System\OVjjrup.exe2⤵PID:8416
-
-
C:\Windows\System\ADGCXCr.exeC:\Windows\System\ADGCXCr.exe2⤵PID:8444
-
-
C:\Windows\System\hlWbTmo.exeC:\Windows\System\hlWbTmo.exe2⤵PID:8460
-
-
C:\Windows\System\svRZOGL.exeC:\Windows\System\svRZOGL.exe2⤵PID:8488
-
-
C:\Windows\System\tEnDZcm.exeC:\Windows\System\tEnDZcm.exe2⤵PID:8516
-
-
C:\Windows\System\rcXMaiR.exeC:\Windows\System\rcXMaiR.exe2⤵PID:8556
-
-
C:\Windows\System\EtbbGwt.exeC:\Windows\System\EtbbGwt.exe2⤵PID:8584
-
-
C:\Windows\System\EpguvlO.exeC:\Windows\System\EpguvlO.exe2⤵PID:8612
-
-
C:\Windows\System\FbbKjpq.exeC:\Windows\System\FbbKjpq.exe2⤵PID:8640
-
-
C:\Windows\System\ASGEuYt.exeC:\Windows\System\ASGEuYt.exe2⤵PID:8656
-
-
C:\Windows\System\RDaYJEI.exeC:\Windows\System\RDaYJEI.exe2⤵PID:8684
-
-
C:\Windows\System\GHcckEI.exeC:\Windows\System\GHcckEI.exe2⤵PID:8716
-
-
C:\Windows\System\HDXzlRX.exeC:\Windows\System\HDXzlRX.exe2⤵PID:8736
-
-
C:\Windows\System\UFQHZMo.exeC:\Windows\System\UFQHZMo.exe2⤵PID:8784
-
-
C:\Windows\System\HFErLWx.exeC:\Windows\System\HFErLWx.exe2⤵PID:8812
-
-
C:\Windows\System\YbsSUxR.exeC:\Windows\System\YbsSUxR.exe2⤵PID:8828
-
-
C:\Windows\System\YRtSAGX.exeC:\Windows\System\YRtSAGX.exe2⤵PID:8868
-
-
C:\Windows\System\ZeDXfas.exeC:\Windows\System\ZeDXfas.exe2⤵PID:8896
-
-
C:\Windows\System\ODhVXad.exeC:\Windows\System\ODhVXad.exe2⤵PID:8924
-
-
C:\Windows\System\nKQNfFO.exeC:\Windows\System\nKQNfFO.exe2⤵PID:8952
-
-
C:\Windows\System\ZPnPVeG.exeC:\Windows\System\ZPnPVeG.exe2⤵PID:8968
-
-
C:\Windows\System\YOizyfd.exeC:\Windows\System\YOizyfd.exe2⤵PID:8984
-
-
C:\Windows\System\QxulCuc.exeC:\Windows\System\QxulCuc.exe2⤵PID:9000
-
-
C:\Windows\System\bQSoHQs.exeC:\Windows\System\bQSoHQs.exe2⤵PID:9028
-
-
C:\Windows\System\JrhdQlL.exeC:\Windows\System\JrhdQlL.exe2⤵PID:9056
-
-
C:\Windows\System\BfkOaUg.exeC:\Windows\System\BfkOaUg.exe2⤵PID:9084
-
-
C:\Windows\System\TaGcsbO.exeC:\Windows\System\TaGcsbO.exe2⤵PID:9100
-
-
C:\Windows\System\MTNdAGa.exeC:\Windows\System\MTNdAGa.exe2⤵PID:9128
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.8MB
MD567af4d71f208a1fa019e8e36bfeb6aab
SHA127b3e5199ef487d665399a8d6abc7178bfabf702
SHA256745fcbd6b69cccaf05f13433ed6a92eddfeb4ffafb7ac70b1cc63cf4c4b8ce80
SHA51239e9551969935ee68a8a684b3b795ec14e12564feeb0ca3ddfc33c64c81ec7d2edcf7f4ae5e3b9ce45004589e0cb880eb609d37f93137484d05595bf6eec241a
-
Filesize
1.8MB
MD5a603a99f8f8b8e52532255dbda78d7aa
SHA1f1777d22e39d004c12b07d7a9f8f45525af8ba7f
SHA2566efe326cdcbd0c87515f8edeb9698c4e9c151f488ec8833bff21b5680c3d6bad
SHA512e258c516c68cb68582b0a68c53ebdcbb687025acb0bf0bfa3a9992c2c0a8db8e68532f7b65c8434d752ebb086f455a9529741e57cb1dc80b74dd5e7db89a0ec7
-
Filesize
1.8MB
MD56317c22ae28866a05fb78a3bc6418c1c
SHA1820897f52b344da26270e0c18484060f54df4fea
SHA25672a7f3828e86d3d2797abbceb60e4306aa2329081b70e682b259dce5afb1a341
SHA512d8f89f3cc24c13f9281b56ec3982ad3ee221b2fbfdd2944e1e0e6f73fd7498b81dcd7560e8c2ac7b1ced0de85a152532c685e2fff249ba81cf674c879702826a
-
Filesize
1.8MB
MD51e8136eb0bf4f7d14fb0ca4a61b25ae1
SHA18ed85e5fca5c16cfbae5f3fdf8abc5b827b6e149
SHA25626847f49bd1f89cb4afc76a85b6a79fd4293fc73234eb9000561e134e48138f0
SHA5127e32980ef536532d8997e30014956e259e146b094eb7082a717f1b05588339c8fe7109942141b87abbea29dde7c89562bdb3db474b1d4f71e5bd641835947aff
-
Filesize
1.8MB
MD5b2a7bb91565c5e10b478a6e0bf333a6c
SHA196fd6c3a9c332a743bf0ee26a6d9e930b247ba2b
SHA256a1f9833a75291b87cb9373f0705f8d622d42f9abdc25ade1d786e1ae3ab05dbe
SHA5126730350a90a6b4639f036b50e6dcd0957305da957f996c64d32e1a1cd9f5fec9c90ee78a0b9ce10a82baa043dcdee96d946a637ba9d757da6dfe81180fed3289
-
Filesize
1.8MB
MD558000eb351a932c3d4ba25dbb5687390
SHA1bcd762394e35f962312027854e0c422e7d104649
SHA2566a6e9706300619fd24ced301c75b1791f980c85a3b4a26fe9240c4ea51ae9e7c
SHA5124114555a744feafc222a1dfb6ccc4cfd56c4f548f1256e13a58706f4886add169ead9fc663280bc4a0e4856d43b3cdd96a25781b81cd4df5973fd8442e7078c6
-
Filesize
1.8MB
MD50507308590e92e6a665d2281b7dc39e9
SHA1aaa9b1cb7b0c935c5d6e21f51b3bf7948ed8d041
SHA2563de534d992fcf21e9d2079e032e40022ccb1e2ee648efc18cf486da903f19be3
SHA51236907b9bd98bd1a37f2d36efed7cf92484d0b49d6236609f62eb5a3033896fc742e338d2dd713aaccc66607ee46744cb65fbe94b31456c92272a91b7a24f8275
-
Filesize
1.8MB
MD5d2ce197411d2349d73891b4de93a45bd
SHA11ef6033394e88c71e9edf2c98607176d1ea0fcfe
SHA256fcf4a9d7a9a81f3cdb50c643fccfe76d169dfebf5d60a5346d28fb93981d6c51
SHA51287fdc0e4563851403af32cc7fca4aa182b0da20ac657e67d2819f45838c39a48de1e67c29d52d8f4a5291e64e3de6478ff7b36f261160015c2fe8dac47c1c6c8
-
Filesize
1.8MB
MD5396963ad7ebd312976befd310b95ee0b
SHA136387ad44c7f08b0d583868253c54e2327acd8ef
SHA25613f62a2b5c5ba2face86dea2d7e1789ae938b2183b9fe365b84674a5406b89a8
SHA512c156c0fa9d124f23c6c6e0e027d55891bf6400d2b503a67277f76721851d42639704c1783e03a8c386ebd1e1286479218b619944e2e0cfaf750cde6a33b757ea
-
Filesize
1.8MB
MD59f92e13e7b19d8b43008c007a3aff1d7
SHA165702f0bbed6828b75a88f7fc0729a836be509f0
SHA256b3aca1486c0630b709b8112002bb5f5aa7ec0a0818c09b044683cd2a6479253b
SHA51251775d554db2c92057fe869843c756abf21b0f0a03557a369f96cad1a943fbdbac00ef520109dc42c8a9008eaf1f64fbddc16528d1f0a61d897b5ee65ed6c9df
-
Filesize
1.8MB
MD50d1f67df5b33b39205757b03bb5ed62d
SHA1b51caf5078c0bb79dbbb9b78ffd9c3b1c05f38c4
SHA25691a5d5f1a9a5a90412ca94becc5a77b726152e25f827d44e857485af85df2c98
SHA512dc02d7c398a10744abec40dea12f11c0c9dbd862513b3507ef5f031cc9d36993e993f52dd5f374e8a4442ab15388a1659a5b860bda89eb7b31f5fe19886dec2f
-
Filesize
1.8MB
MD55d31a63bd06033a2ac41ba034326a17d
SHA127513a56c06836d06f2ff1bcac9b567daeb386ba
SHA256c7d10887a04aaecb0a9d1906712106c512ae9e5dd781e231fa4b2283389365d7
SHA51293eb531412321428abd5667302df19a7bbf11330019cec9be07035b3d7fc7ec04808c63cd2295afe9fa8f75a2f3a5fd80552788e69e8374e6d7d9f12eae8bd7c
-
Filesize
1.8MB
MD53cc95a9fcf830562c0ae5c45758d0c74
SHA1e2b3d61b3612ce08372da5324075125fd315b732
SHA256661ca3600732a50a3104357794117b49b9bc73543b95befb5749d54c937d5e12
SHA5124934d602b2312eb19fd56d5ed0db7c587ec54f05667dd3b3484e9a0d99c9daefdded1b6a694a7656280f010e95337646773e429ec527c6776ce26641a6ca0a38
-
Filesize
1.8MB
MD5e5922b7dda1449e39be65a9ebe8973eb
SHA1ae10fba796e3d09ee9bd9bbb8e6db77278953f9a
SHA256d615326e3d8bd5f430d57a01dc7cdfa314f06fc17a0a296d41255714cef19de4
SHA512d2a00b60181f3db07cf88f04dd6bd05b8e68f46dc8935bf067fb07d780e4667d63abc252dd975dbfc0484b1ca04b9aa7b6ef39ebffe26e7e0035c31f5999ecb7
-
Filesize
1.8MB
MD59b12895f4f2b0df6fc89453379a398a5
SHA1cf64cf94c20f7121d52b38875104e6ce741287c1
SHA25630098bc7194392cfa87581e8bf3e973bb1a83ac9640e3735d515181426d9bead
SHA5127e9805a755e0448df7928380e73cb80c262762af6d6a22f65743fce2baacccf800454174babe4b21ecd8e907add3be3499163ecc2843d529b368e7f7dbc90b9f
-
Filesize
1.8MB
MD5f6bb6938b3d03a10401c9ee3b066e9ab
SHA14f1b013869e9e3d607d3cf4b83ef94b7da1da1b6
SHA256f27e0efffdb1ec0ac40032dca27d92acc895bf5cd628e543f18bcef58728a6cb
SHA5128335bb92de22bb42d6fc31d927367995b83d2d185487cf58f679677cd583d4c61892ffbe0933857008f6f5858b3b1191ad3209da1e3b37f6cecff40f2dd73e3b
-
Filesize
1.8MB
MD5241b65fcdcb4c5c9147d6e25fc9f2122
SHA1cbad979dd1f2c26b392384011cd16653ffbdda89
SHA256953d22277afb64791508a63bd75adfd0fa297280c97bbee01c94ee37cb2bbc43
SHA5126d7eb809df21c99918ba1fb6321112531617c89328abf945653dd40c30237bf921cdb72abfe5aa366e6761a386cee640e2547c2aa44c6212549b20959a0a873c
-
Filesize
1.8MB
MD515f56599bd27277242bc981474cfc3d4
SHA1a8dcce728b91cbe0c63f37da7836a545615465bb
SHA2562c161dbc4bcc8827b4fa7eec762d4dc6f479e6e92e8f09f1c7e39b08de0569a7
SHA5125a7763b53d30e783c9bb880b4716b38ea0688d064811c587295b174876d7130109468586c6e9495a7deddaa283ba42d2bcb90d83d36758e383b87521cee1c823
-
Filesize
1.8MB
MD55518a45d77b256fbb07b995c8b5b9fa0
SHA1a10d109c94f5ca0515dbf26b773e9fe3f5d387a6
SHA256673398544564f8114faf48ffee90af30a4ef91d5b4d69529c699f46262cf80fc
SHA512576390ca65cb1b7d3be35c6d24ae88d580c660541819c524ed7520f60030d553a4cfe1063fc96ce617c6bed36295a86a65799e89f6382c149f1c58d201dff520
-
Filesize
1.8MB
MD527fe8c8e8cae41678dcbaad05913cfe2
SHA1d303194d81f97499b9093c37fde85489021fefca
SHA2568b776cb48e079cbb395738a2718f0e5b35a1591ff78e2eb0aa0c7b1fda8e7114
SHA512fece3ca10d77bec1a36febecd3378a6300a487c4c3515945b7df21208fd2c5ea56fc9a5ac8dc0258ab0e3181ae9429685c043d71d4a10387bc458e94cd4325f9
-
Filesize
1.8MB
MD5dba4c5bd4824bd5171bf9aa965bed19f
SHA195afd4430de3cfa85e285bb7e625331194a4cc34
SHA2565cb63c1db0a6f65be0abad38566728f275176500c8e71490b421375dca1bc7a6
SHA512b3f43ba1ef4ae130327167e68fbefec95d1542724354e6ac283b022893a407877c9e362386fef40566b1ba5d0db1471bb04df36f17c902814062fbe32b28962e
-
Filesize
1.8MB
MD5476ab86f7407bf4ddf9c108af30b9cfd
SHA1e2ed815c754a5664709121bce91144325c7b0336
SHA256c74f1a3f6ed166701e920d53e92df2e01a7150985c49356502c8c3f48a0bf1ba
SHA512dea5eef71c53df7c76df159ab1d7275b0e1f776788698f1b7fb561a3e779b3d5c04d280c7c90d03304d09977e5792caadc9deac03a83864fe1e8bdedcb44bb13
-
Filesize
1.8MB
MD58ec5f74a9b6f56bcb60053c4ec62967c
SHA196639fc988233bbeb30fd82efc6c132081d922b7
SHA2567063b970738352d4664269ba3d8b70e0e3aaa3e510c62e3a9686b30481ae59d5
SHA5120ac631c83ba8e49ad1c749fd8c54e1bc61a2b569859177c33b485e7ecbec0f54530ea8ba46cff6ac8d006e75632d71f65a0d6caf11f8c40035b198aaedf6fe74
-
Filesize
1.8MB
MD59433dee90419ce01fe6c83ceeb156cf4
SHA19c6e8782b1d2fb8f5eb29881e75725bf2f4cd30c
SHA25606fa391a2eb4ce07bacb72431245b73a62d3e455a25dafcc3f4928aee0edeef8
SHA512cc0a9cb153a7eab0bd92db301c40b1ff71b8c17301452a5de7dc6c8062d9cd8e69a6f04ac09760dd8c8c1c9deb458ceda3bb20cfb5bab4b62204dc96127aaaa0
-
Filesize
1.8MB
MD56e0a7e93697791239ed748d27d885201
SHA1f3be57c464a5b13b831442e3263603641b312da3
SHA256d1bac8979aad48528031694fcb8fd2c24a9802c035fb9dc9a0eed7b82fa18142
SHA512f05019c33117853ea1d7d5b6e1f21e1356033fe190fd10f2f03ab840841179b6c34117f45ba8501cd550d59277064a2f5e1fb93fc042381b700ca434703d1ee5
-
Filesize
1.8MB
MD593586bf174fd40d88460d7d384618f94
SHA142aa9ddb9b39ba0cc713966efb4fb7ad781d68ec
SHA2565125850043201e29918041586126b17eb52797412230cfec05a113a13aa00e22
SHA5125a3256bdff64ec9874d19e49da0a74b7725a8ed3ff646b9232f6e4045a27368eeac5ac290fc18327a60b97fa7a8d4e2bd71227de3996ce3e63f831b2cb34a761
-
Filesize
1.8MB
MD5398bae7e878d4214917fc7f2f4cc9337
SHA12d0169feee56e7420b69e84ef2a5ef23922f4e43
SHA2569edef02027c03a485bb76fe5458e9b97f17c18d16d2ab14e1cc25214153c951f
SHA51252285d7a949137f1571c33522c3547094e456174cd730eafa7f33c667a40070936f978f3458d3e1944d4beee29caac9b361c363a97c88bd5fd7b750c03481647
-
Filesize
1.8MB
MD544974344785b12204e07a78adea732cc
SHA15127068e22743dbf560449c34fe9ae0c015d1109
SHA25622aeb71314a3047df3c98a149bd2a68b5cc6196ed8023cf12a61eab9bccdef51
SHA5121415aae329a98a72fff411e9079dbad11804934658d45932f719ae56e2deec9195af2617b37dea1e4ce10dcd5484ab2492273e7d2ac8bff7626f5482979f1ed3
-
Filesize
1.8MB
MD5eb5f3ba69471fa958300044ae8755518
SHA161626cb686f6e19bd9516adce51e7eb658f8228d
SHA256257450640bf7797d7a7457d5844cac71751a9e16d4d573a4c206f332d61a165f
SHA512861fb1247c5ecc01da45d63a03148ec0b92dad71c22b8befad5877f0663e42a0b053ef485c095c70ce41a55426929866cfb9f67bc5443d28f8a6ced9a6107551
-
Filesize
1.8MB
MD5388ffd2aa27835d048dc628fea5e04fb
SHA1a2f66e617ca3f53bb350e1236b7f3f5ffa0d499b
SHA2560d58bc7e036cf7167c7bb40a7858a8805abd351c302f5c636af5e9cf691a5cb5
SHA51288e7378e31a79ce554241f5db23e6ec0ce678d4aa0674a1b3646a3af78d5038296b8b46543dcd7661db99ef980506906878cb87fc8a7dd044904ded83cd84dfa
-
Filesize
1.8MB
MD53c85e51e5f6358411e9eaeeee1974023
SHA1f36a0ede031936fa8de3149c10863a0c9bf524bc
SHA2568add908a73839787021301101a208b7c09c27421c0312d0e711ce331de7e545d
SHA512c2b5c2d7e16d3e633eaa221e3f17fc9f8749931d0751b644405df37e7e1c2ee43a443431d9bf262ae4b9015722718d1d5267b2b9d531b46c7605c9edf0209e27
-
Filesize
1.8MB
MD5489f5097699d86fa3f7e89191405fafb
SHA13ae86f08eb6b63433f78878fe78227c15e648095
SHA256e6a61eae0f97eb774633ce61e9b1a147a77ba6111621b1f09af2ee1b2fb24a55
SHA512e7dc40a58a271029cb143676dc802f4ace53294229cd6fb738843fce8abc52ec0ee4e765cae0cd8edea0db3fe2a7951eadd3c5ea368da21bb2fa91b102860c2d
-
Filesize
1.8MB
MD5559984c4cb9ca31c72d544af404d486d
SHA16a59c6f1d682f224f975f4bff8cf31f10abb477f
SHA2562e34ffe190639cf3b8bf040d37b1f6cbb05e23998bd9cfa0222931fa2163bf80
SHA512e53cfeb0cca5585c1e821053028b04b27982d0040655e28c622c0add779689561c05a537c19698d6445ca41a2d0b7eb700040de48942dd3749e72987f2ca1aed