Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
56s -
max time network
194s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
14/10/2023, 19:14
Behavioral task
behavioral1
Sample
NEAS.cffeb216b375113963044405771b6150.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.cffeb216b375113963044405771b6150.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.cffeb216b375113963044405771b6150.exe
-
Size
112KB
-
MD5
cffeb216b375113963044405771b6150
-
SHA1
cb133dfd6756032fa8f1a7cc89cd8d8bd2fe20c2
-
SHA256
aff4f46563f264fa63f268873862caa9d6b6e4de9e0e7c5f44f9a5e9697bb7a6
-
SHA512
1f696b94200a921682d726aa79d01c0e98387331ca3725c46203b1e1ccd9e340c2f4441e526f054a9ef315b65515fbac1ce8fe359bf7f402e0aeb5553021eb8d
-
SSDEEP
3072:7jbLl/gvQout81Tj4mYWR/R4nkPR/1aVuyJNpqeru+Uu7t:7jluQoSWIo5R4nM/40yJNpqerh
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe Key value queried \REGISTRY\USER\S-1-5-21-2344688013-2965468717-2034126-1000\Control Panel\International\Geo\Nation NEAS.cffeb216b375113963044405771b6150.exe -
resource yara_rule behavioral2/memory/5012-0-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/files/0x000400000001da51-5.dat upx behavioral2/memory/3800-9-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4944-20-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5012-25-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1308-26-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1868-27-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4428-28-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1672-29-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2672-30-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3800-31-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4576-32-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3904-33-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4188-34-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4944-35-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4660-36-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1308-37-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4892-38-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1920-39-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1056-40-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1868-41-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4428-42-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1672-45-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1496-46-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/2672-47-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4996-48-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4576-49-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/3904-50-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/5052-51-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4188-52-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1516-53-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4892-54-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1920-55-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4216-56-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/4808-57-0x0000000000400000-0x000000000041F000-memory.dmp upx behavioral2/memory/1056-96-0x0000000000400000-0x000000000041F000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" NEAS.cffeb216b375113963044405771b6150.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\P: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\S: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\T: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\X: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\H: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\R: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\E: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\Q: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\Z: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\A: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\G: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\I: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\J: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\K: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\M: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\N: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\O: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\B: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\V: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\W: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\Y: NEAS.cffeb216b375113963044405771b6150.exe File opened (read-only) \??\U: NEAS.cffeb216b375113963044405771b6150.exe -
Drops file in Program Files directory 16 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Templates\spanish beastiality public .avi.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\italian action several models swallow .rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Microsoft Office\Updates\Download\italian handjob horse sleeping .zip.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\lesbian full movie ash black hairunshaved .rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\spanish cum nude [milf] 40+ .mpeg.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Google\Temp\french horse sperm several models .avi.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\malaysia bukkake full movie feet boots (Sonja).mpg.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\american cum bukkake sleeping glans ash (Kathrin).mpg.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Common Files\microsoft shared\black gay several models legs YEâPSè& (Tatjana,Britney).zip.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\african gay [bangbus] bedroom .avi.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\horse fucking voyeur bedroom (Christine,Sandy).rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\asian animal cum licking .rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\handjob fetish licking .rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\fucking xxx big .rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Google\Update\Download\handjob gay big hole .rar.exe NEAS.cffeb216b375113963044405771b6150.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\kicking beast big swallow .mpeg.exe NEAS.cffeb216b375113963044405771b6150.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\mssrv.exe NEAS.cffeb216b375113963044405771b6150.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5012 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 4944 NEAS.cffeb216b375113963044405771b6150.exe 4944 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 1308 NEAS.cffeb216b375113963044405771b6150.exe 1308 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 1868 NEAS.cffeb216b375113963044405771b6150.exe 1868 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 4428 NEAS.cffeb216b375113963044405771b6150.exe 4428 NEAS.cffeb216b375113963044405771b6150.exe 1672 NEAS.cffeb216b375113963044405771b6150.exe 1672 NEAS.cffeb216b375113963044405771b6150.exe 4944 NEAS.cffeb216b375113963044405771b6150.exe 4944 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 2672 NEAS.cffeb216b375113963044405771b6150.exe 2672 NEAS.cffeb216b375113963044405771b6150.exe 1308 NEAS.cffeb216b375113963044405771b6150.exe 1308 NEAS.cffeb216b375113963044405771b6150.exe 4576 NEAS.cffeb216b375113963044405771b6150.exe 4576 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 3904 NEAS.cffeb216b375113963044405771b6150.exe 3904 NEAS.cffeb216b375113963044405771b6150.exe 1868 NEAS.cffeb216b375113963044405771b6150.exe 1868 NEAS.cffeb216b375113963044405771b6150.exe 4188 NEAS.cffeb216b375113963044405771b6150.exe 4188 NEAS.cffeb216b375113963044405771b6150.exe 4660 NEAS.cffeb216b375113963044405771b6150.exe 4660 NEAS.cffeb216b375113963044405771b6150.exe 4944 NEAS.cffeb216b375113963044405771b6150.exe 4944 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 3800 NEAS.cffeb216b375113963044405771b6150.exe 4892 NEAS.cffeb216b375113963044405771b6150.exe 4892 NEAS.cffeb216b375113963044405771b6150.exe 1308 NEAS.cffeb216b375113963044405771b6150.exe 1308 NEAS.cffeb216b375113963044405771b6150.exe 1920 NEAS.cffeb216b375113963044405771b6150.exe 1920 NEAS.cffeb216b375113963044405771b6150.exe 1056 NEAS.cffeb216b375113963044405771b6150.exe 1056 NEAS.cffeb216b375113963044405771b6150.exe 4428 NEAS.cffeb216b375113963044405771b6150.exe 4428 NEAS.cffeb216b375113963044405771b6150.exe 1672 NEAS.cffeb216b375113963044405771b6150.exe 1672 NEAS.cffeb216b375113963044405771b6150.exe 2672 NEAS.cffeb216b375113963044405771b6150.exe 2672 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 5012 NEAS.cffeb216b375113963044405771b6150.exe 1868 NEAS.cffeb216b375113963044405771b6150.exe 1868 NEAS.cffeb216b375113963044405771b6150.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 3800 5012 NEAS.cffeb216b375113963044405771b6150.exe 83 PID 5012 wrote to memory of 3800 5012 NEAS.cffeb216b375113963044405771b6150.exe 83 PID 5012 wrote to memory of 3800 5012 NEAS.cffeb216b375113963044405771b6150.exe 83 PID 5012 wrote to memory of 4944 5012 NEAS.cffeb216b375113963044405771b6150.exe 84 PID 5012 wrote to memory of 4944 5012 NEAS.cffeb216b375113963044405771b6150.exe 84 PID 5012 wrote to memory of 4944 5012 NEAS.cffeb216b375113963044405771b6150.exe 84 PID 3800 wrote to memory of 1308 3800 NEAS.cffeb216b375113963044405771b6150.exe 85 PID 3800 wrote to memory of 1308 3800 NEAS.cffeb216b375113963044405771b6150.exe 85 PID 3800 wrote to memory of 1308 3800 NEAS.cffeb216b375113963044405771b6150.exe 85 PID 5012 wrote to memory of 1868 5012 NEAS.cffeb216b375113963044405771b6150.exe 86 PID 5012 wrote to memory of 1868 5012 NEAS.cffeb216b375113963044405771b6150.exe 86 PID 5012 wrote to memory of 1868 5012 NEAS.cffeb216b375113963044405771b6150.exe 86 PID 4944 wrote to memory of 4428 4944 NEAS.cffeb216b375113963044405771b6150.exe 87 PID 4944 wrote to memory of 4428 4944 NEAS.cffeb216b375113963044405771b6150.exe 87 PID 4944 wrote to memory of 4428 4944 NEAS.cffeb216b375113963044405771b6150.exe 87 PID 3800 wrote to memory of 1672 3800 NEAS.cffeb216b375113963044405771b6150.exe 88 PID 3800 wrote to memory of 1672 3800 NEAS.cffeb216b375113963044405771b6150.exe 88 PID 3800 wrote to memory of 1672 3800 NEAS.cffeb216b375113963044405771b6150.exe 88 PID 1308 wrote to memory of 2672 1308 NEAS.cffeb216b375113963044405771b6150.exe 89 PID 1308 wrote to memory of 2672 1308 NEAS.cffeb216b375113963044405771b6150.exe 89 PID 1308 wrote to memory of 2672 1308 NEAS.cffeb216b375113963044405771b6150.exe 89 PID 5012 wrote to memory of 4576 5012 NEAS.cffeb216b375113963044405771b6150.exe 90 PID 5012 wrote to memory of 4576 5012 NEAS.cffeb216b375113963044405771b6150.exe 90 PID 5012 wrote to memory of 4576 5012 NEAS.cffeb216b375113963044405771b6150.exe 90 PID 1868 wrote to memory of 3904 1868 NEAS.cffeb216b375113963044405771b6150.exe 91 PID 1868 wrote to memory of 3904 1868 NEAS.cffeb216b375113963044405771b6150.exe 91 PID 1868 wrote to memory of 3904 1868 NEAS.cffeb216b375113963044405771b6150.exe 91 PID 4944 wrote to memory of 4660 4944 NEAS.cffeb216b375113963044405771b6150.exe 92 PID 4944 wrote to memory of 4660 4944 NEAS.cffeb216b375113963044405771b6150.exe 92 PID 4944 wrote to memory of 4660 4944 NEAS.cffeb216b375113963044405771b6150.exe 92 PID 3800 wrote to memory of 4188 3800 NEAS.cffeb216b375113963044405771b6150.exe 93 PID 3800 wrote to memory of 4188 3800 NEAS.cffeb216b375113963044405771b6150.exe 93 PID 3800 wrote to memory of 4188 3800 NEAS.cffeb216b375113963044405771b6150.exe 93 PID 1308 wrote to memory of 4892 1308 NEAS.cffeb216b375113963044405771b6150.exe 94 PID 1308 wrote to memory of 4892 1308 NEAS.cffeb216b375113963044405771b6150.exe 94 PID 1308 wrote to memory of 4892 1308 NEAS.cffeb216b375113963044405771b6150.exe 94 PID 4428 wrote to memory of 1920 4428 NEAS.cffeb216b375113963044405771b6150.exe 95 PID 4428 wrote to memory of 1920 4428 NEAS.cffeb216b375113963044405771b6150.exe 95 PID 4428 wrote to memory of 1920 4428 NEAS.cffeb216b375113963044405771b6150.exe 95 PID 1672 wrote to memory of 1056 1672 NEAS.cffeb216b375113963044405771b6150.exe 96 PID 1672 wrote to memory of 1056 1672 NEAS.cffeb216b375113963044405771b6150.exe 96 PID 1672 wrote to memory of 1056 1672 NEAS.cffeb216b375113963044405771b6150.exe 96 PID 2672 wrote to memory of 1496 2672 NEAS.cffeb216b375113963044405771b6150.exe 97 PID 2672 wrote to memory of 1496 2672 NEAS.cffeb216b375113963044405771b6150.exe 97 PID 2672 wrote to memory of 1496 2672 NEAS.cffeb216b375113963044405771b6150.exe 97 PID 5012 wrote to memory of 4996 5012 NEAS.cffeb216b375113963044405771b6150.exe 99 PID 5012 wrote to memory of 4996 5012 NEAS.cffeb216b375113963044405771b6150.exe 99 PID 5012 wrote to memory of 4996 5012 NEAS.cffeb216b375113963044405771b6150.exe 99 PID 1868 wrote to memory of 3556 1868 NEAS.cffeb216b375113963044405771b6150.exe 100 PID 1868 wrote to memory of 3556 1868 NEAS.cffeb216b375113963044405771b6150.exe 100 PID 1868 wrote to memory of 3556 1868 NEAS.cffeb216b375113963044405771b6150.exe 100 PID 4944 wrote to memory of 5052 4944 NEAS.cffeb216b375113963044405771b6150.exe 101 PID 4944 wrote to memory of 5052 4944 NEAS.cffeb216b375113963044405771b6150.exe 101 PID 4944 wrote to memory of 5052 4944 NEAS.cffeb216b375113963044405771b6150.exe 101 PID 3800 wrote to memory of 1516 3800 NEAS.cffeb216b375113963044405771b6150.exe 102 PID 3800 wrote to memory of 1516 3800 NEAS.cffeb216b375113963044405771b6150.exe 102 PID 3800 wrote to memory of 1516 3800 NEAS.cffeb216b375113963044405771b6150.exe 102 PID 1308 wrote to memory of 796 1308 NEAS.cffeb216b375113963044405771b6150.exe 103 PID 1308 wrote to memory of 796 1308 NEAS.cffeb216b375113963044405771b6150.exe 103 PID 1308 wrote to memory of 796 1308 NEAS.cffeb216b375113963044405771b6150.exe 103 PID 4428 wrote to memory of 4216 4428 NEAS.cffeb216b375113963044405771b6150.exe 104 PID 4428 wrote to memory of 4216 4428 NEAS.cffeb216b375113963044405771b6150.exe 104 PID 4428 wrote to memory of 4216 4428 NEAS.cffeb216b375113963044405771b6150.exe 104 PID 1672 wrote to memory of 4808 1672 NEAS.cffeb216b375113963044405771b6150.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:10492
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:14748
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:10308
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:14716
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:9744
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:14572
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:11820
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:15248
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:10720
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:14808
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:10316
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:14796
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:12664
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:16240
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:9856
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:14644
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:11756
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:7672
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:12696
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:16200
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:12780
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:16208
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:6616
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:13724
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:16768
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:8212
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10980
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15028
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:8052
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10696
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14708
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:9368
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11552
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15292
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:12160
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16152
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10776
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15100
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10508
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14724
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:9456
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11604
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14544
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:13224
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16312
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10688
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14840
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10760
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15052
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:13760
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16816
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10800
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14832
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10752
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15044
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:6596
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:12684
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16272
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:8168
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10964
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14964
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:8160
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10972
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15036
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10400
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14788
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:12144
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16092
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11828
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15300
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10324
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14700
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11800
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15316
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:12168
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16168
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10860
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15340
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11772
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15664
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11748
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14556
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11740
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15264
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:9140
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11508
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15224
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:6652
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:13920
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:19580
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:8032
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11020
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15124
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:8180
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10908
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15092
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10884
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15076
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11792
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15672
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10332
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14684
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10452
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14772
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:9848
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14608
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10736
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14864
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12796
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16280
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12640
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16192
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10828
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14856
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12656
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16216
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11764
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15636
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:6572
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13716
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:17120
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:8104
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:10708
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:14676
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:8004
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"6⤵PID:15932
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10680
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14692
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:13232
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:8316
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10728
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14880
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11784
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15284
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10892
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15084
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:11808
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15308
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10868
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14912
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:12612
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16184
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10852
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14848
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10484
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14740
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:10744
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14816
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:14580
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:6588
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:13684
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:16472
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:8152
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10900
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14904
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:7916
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10468
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14764
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11860
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15256
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12632
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16232
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:9384
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11544
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14468
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11836
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15272
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:9376
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13464
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16436
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12152
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16120
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12812
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16288
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12208
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16344
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10876
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14972
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13692
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16676
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13708
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16692
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:6580
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12828
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16296
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:7956
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:11012
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:14920
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:7868
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"5⤵PID:15408
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10460
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14780
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:8928
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11480
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15112
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:9164
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11500
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15132
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:9868
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14628
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12820
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16248
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13240
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16304
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10792
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14824
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:11852
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16076
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10476
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14756
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:10784
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:15060
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13700
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16684
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:12672
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16176
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:13752
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:16824
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:8440
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:11228
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:15192
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:7268
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"4⤵PID:14616
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:10252
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:14656
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:8744
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:3744
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:15068
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:9824
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:14636
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:10944
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:14932
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:9396
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:13776
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:19596
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:584
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:9232
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:13472
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:16444
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:12788
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:16264
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:12804
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:16256
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:10768
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:15352
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:13732
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:16668
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:12648
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:16224
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:10500
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:14732
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:6532
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:13740
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"3⤵PID:16464
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:8568
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:11260
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.cffeb216b375113963044405771b6150.exe"2⤵PID:15160
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\malaysia bukkake full movie feet boots (Sonja).mpg.exe
Filesize267KB
MD52e6f10686714a5af01c977e0dedd5756
SHA166d011d84de5869b7e3bd1c43970569672d42bc4
SHA25695dfdce58e5bb76a44752dbac7b3298440cb1d9ddaa21fe58fe0d42df46d9944
SHA5121e6d717d8440fb16045672cfb9e5b8022ca2612b5c03413a9af149e16e32db03b6f824edfd243429669bc9ac22da4f73da9a4cd3248df7865a977dba1f2d2ffa