Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
163s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 13:05
Behavioral task
behavioral1
Sample
NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe
-
Size
121KB
-
MD5
7dbcc6fdec7174d25164814e535e2bd3
-
SHA1
d42731bd73a8be7f3cfa07bfecc70f901e065d60
-
SHA256
c9920822dee7c9e981ab364e459f0fcbb5291d47a62873ba980ed5fa188f1419
-
SHA512
424511fbbdf899c9f977b9585a5a8ffd7f6558e7882d1727e1b7fb40d436881bf772ba8daed50262bd575af4bf03c71be4f4601dc604ca67166bcdbef1f570d5
-
SSDEEP
3072:wvs4dDXEGCLElS1Tj4mYWR/R4nkPR/1aVuyHaKPiFs0vKHJ8q:sPDLCL9Io5R4nM/40yt4yJV
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe Key value queried \REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\Control Panel\International\Geo\Nation NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe -
resource yara_rule behavioral2/memory/1900-0-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/files/0x000600000002326d-5.dat upx behavioral2/memory/2040-10-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4036-11-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1900-12-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1684-13-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4996-14-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2612-15-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1284-16-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2040-17-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1836-19-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1412-21-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4516-22-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1620-23-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4036-20-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2432-24-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4936-25-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2796-26-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1684-27-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4996-28-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1720-29-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2612-30-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1284-31-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4524-32-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1548-33-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1836-34-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1412-35-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5096-36-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2088-37-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4516-38-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2584-39-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4936-41-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/336-42-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4168-43-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3028-44-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2740-45-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4524-46-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/920-47-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2056-48-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1548-49-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3052-50-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5096-51-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2584-55-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4832-69-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4104-64-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/336-73-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3240-74-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/1420-96-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4628-92-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5136-100-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5128-108-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5144-103-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5272-112-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5536-117-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/4168-122-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/3028-127-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5800-120-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5512-155-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5648-159-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/6016-166-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/5784-162-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/2740-151-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/6032-189-0x0000000000400000-0x000000000041C000-memory.dmp upx behavioral2/memory/6052-195-0x0000000000400000-0x000000000041C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe" NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\L: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\O: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\W: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\A: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\N: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\S: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\T: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\Z: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\P: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\R: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\U: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\V: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\J: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\K: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\M: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\Q: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\B: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\E: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\G: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\H: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\X: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File opened (read-only) \??\Y: NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\xxx girls fishy .avi.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\black action xxx girls (Sarah).rar.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\black beastiality xxx hidden glans .avi.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\trambling [bangbus] ash (Anniston,Samantha).zip.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Microsoft Office\Updates\Download\american beastiality lesbian big granny .mpeg.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\tyrkish gang bang sperm girls hole wifey (Karin).mpg.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Common Files\microsoft shared\fucking masturbation glans .mpeg.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe File created C:\Program Files\Microsoft Office\root\Templates\lingerie voyeur glans .mpg.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\mssrv.exe NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1284 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1284 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1836 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1836 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2088 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2088 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 2040 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 84 PID 1900 wrote to memory of 2040 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 84 PID 1900 wrote to memory of 2040 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 84 PID 1900 wrote to memory of 4036 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 85 PID 1900 wrote to memory of 4036 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 85 PID 1900 wrote to memory of 4036 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 85 PID 2040 wrote to memory of 1620 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 86 PID 2040 wrote to memory of 1620 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 86 PID 2040 wrote to memory of 1620 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 86 PID 1900 wrote to memory of 1684 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 87 PID 1900 wrote to memory of 1684 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 87 PID 1900 wrote to memory of 1684 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 87 PID 2040 wrote to memory of 4996 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 88 PID 2040 wrote to memory of 4996 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 88 PID 2040 wrote to memory of 4996 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 88 PID 4036 wrote to memory of 2612 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 90 PID 4036 wrote to memory of 2612 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 90 PID 4036 wrote to memory of 2612 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 90 PID 1620 wrote to memory of 1284 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 89 PID 1620 wrote to memory of 1284 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 89 PID 1620 wrote to memory of 1284 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 89 PID 1900 wrote to memory of 1836 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 91 PID 1900 wrote to memory of 1836 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 91 PID 1900 wrote to memory of 1836 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 91 PID 1684 wrote to memory of 2088 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 92 PID 1684 wrote to memory of 2088 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 92 PID 1684 wrote to memory of 2088 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 92 PID 2040 wrote to memory of 4516 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 96 PID 2040 wrote to memory of 4516 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 96 PID 2040 wrote to memory of 4516 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 96 PID 1620 wrote to memory of 1412 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 93 PID 1620 wrote to memory of 1412 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 93 PID 1620 wrote to memory of 1412 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 93 PID 4036 wrote to memory of 2432 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 94 PID 4036 wrote to memory of 2432 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 94 PID 4036 wrote to memory of 2432 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 94 PID 4996 wrote to memory of 4936 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 95 PID 4996 wrote to memory of 4936 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 95 PID 4996 wrote to memory of 4936 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 95 PID 2612 wrote to memory of 2796 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 97 PID 2612 wrote to memory of 2796 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 97 PID 2612 wrote to memory of 2796 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 97 PID 1900 wrote to memory of 1720 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 98 PID 1900 wrote to memory of 1720 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 98 PID 1900 wrote to memory of 1720 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 98 PID 1684 wrote to memory of 4524 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 99 PID 1684 wrote to memory of 4524 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 99 PID 1684 wrote to memory of 4524 1684 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 99 PID 2040 wrote to memory of 2056 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 100 PID 2040 wrote to memory of 2056 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 100 PID 2040 wrote to memory of 2056 2040 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 100 PID 1620 wrote to memory of 1548 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 101 PID 1620 wrote to memory of 1548 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 101 PID 1620 wrote to memory of 1548 1620 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 101 PID 4036 wrote to memory of 5096 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 102 PID 4036 wrote to memory of 5096 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 102 PID 4036 wrote to memory of 5096 4036 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 102 PID 4996 wrote to memory of 2584 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 103 PID 4996 wrote to memory of 2584 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 103 PID 4996 wrote to memory of 2584 4996 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 103 PID 2612 wrote to memory of 4104 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 104 PID 2612 wrote to memory of 4104 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 104 PID 2612 wrote to memory of 4104 2612 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 104 PID 1900 wrote to memory of 336 1900 NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:6084
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:11652
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:16648
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:7824
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:4920
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10488
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:14296
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:5512
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:8960
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:13672
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:12444
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:8184
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6684
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13404
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9104
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:18264
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:12520
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8044
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:7420
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:10900
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10868
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:15060
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6436
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:12836
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10140
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8440
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:17836
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11252
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16376
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10280
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:14036
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7680
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:15076
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10392
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14284
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6060
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:11700
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:16612
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7816
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:17372
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10648
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:1612
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7024
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13308
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8828
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:14936
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13888
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6132
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11464
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16052
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7904
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16656
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10480
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:14232
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:8432
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:17528
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:11064
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:16008
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6560
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13292
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8612
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:18272
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11692
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16464
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:5888
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10288
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:14044
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7452
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13764
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9728
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13960
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6016
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10268
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:14028
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7608
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:14060
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10368
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13376
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:5136
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7236
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:4304
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10860
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:15256
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6488
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:12884
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9344
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8548
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:17496
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11280
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16044
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6900
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13720
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9112
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13632
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:12408
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:4660
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6116
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11088
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16076
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7696
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:15804
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10504
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:14252
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:2056
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9060
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14020
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7392
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13924
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:9276
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13608
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13420
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6052
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11708
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16672
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7968
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11800
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10616
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13896
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8452
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:18216
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10300
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16304
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6388
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:12784
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:8200
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:17520
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:10996
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:15796
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:5648
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:9188
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"7⤵PID:13628
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:12876
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:7232
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6840
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13300
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9180
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:18392
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13156
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10416
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:5828
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10228
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13992
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7384
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:13384
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:9324
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13428
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:12144
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:17084
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7704
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:17488
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10496
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14312
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:5144
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8404
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:11992
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11072
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16068
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6496
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:12208
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:17052
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8460
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:17480
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11288
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:15268
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:5128
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8472
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:17472
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11244
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16296
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6568
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13284
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16356
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8632
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11888
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16688
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6032
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10636
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14320
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7616
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:15872
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10384
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:14164
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6076
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10472
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14240
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7600
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14052
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10036
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13976
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7496
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:684
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10852
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:15144
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6272
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13252
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16488
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:8028
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11936
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:10980
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:15564
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:6100
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:11684
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:16604
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:7948
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:10888
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10524
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14304
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:5204
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8700
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"6⤵PID:17464
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11516
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16196
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6644
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:12828
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8040
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8692
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:18280
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11632
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16664
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:5800
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10236
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:14000
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6248
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13492
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:9232
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13636
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13412
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11080
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16084
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7688
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:4496
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10624
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7176
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6596
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13276
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8788
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11020
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11960
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16704
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6044
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11056
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16288
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:7960
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:17456
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:10516
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:14276
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6108
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:11036
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16280
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:7660
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:16000
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:10376
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:14156
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:5272
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8412
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:10828
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11472
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16060
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6676
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13268
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16444
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:8640
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:17512
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:11640
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:16696
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:5536
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:9020
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:17844
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:12128
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16984
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:13436
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:8804
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:18208
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:12228
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:16336
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:6748
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:13260
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:8796
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"5⤵PID:8488
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11968
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16848
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6092
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:11140
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:16032
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:7548
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:14272
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:9892
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:13968
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:6380
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:12200
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:17044
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:8048
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"4⤵PID:17504
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:10988
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:15788
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:5784
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:9860
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:13984
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:6204
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:4740
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:9152
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"3⤵PID:13500
-
-
-
C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS7dbcc6fdec7174d25164814e535e2bd3exe_JC.exe"2⤵PID:13444
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\black action xxx girls (Sarah).rar.exe
Filesize606KB
MD53e796079a857733813b9c9e40e4e4ea7
SHA144a3b1f8cc5809eb566141a6c4c3033af2645e30
SHA25647e313d9add1ad4ef27da21e38b14171e19187c431ca26e76d4a261fbf3dff44
SHA512119665d14b4ec2176f2f49b35021a681e662d4020ad169d933293d3096e2f49ab46f92f1d53ebf3b903cc9be368120a59905040dcd356db4814aaea46006a27d