Analysis

  • max time kernel
    20s
  • max time network
    83s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/10/2023, 17:14 UTC

General

  • Target

    NEAS.045d39eec9584a990b27d096348f6f57_JC.exe

  • Size

    1.5MB

  • MD5

    045d39eec9584a990b27d096348f6f57

  • SHA1

    62c1d171834a630f8f737cf6c092488ec66d5d89

  • SHA256

    05a358f1344d1651249b4811963b692edc5db60fdfe1b6d1178a7c2ba2b62978

  • SHA512

    da31ce8b3c4435224b1bcf014ec9ee53f49c4b701bb16b7ad14a517f0374fa8110b53bb612e6648caff8b960104500dbb3bd612451dc2d0ba66783ffdca39ea2

  • SSDEEP

    24576:A8LCe0ehynTDBCNzMgoytu51ZuSvtRXDnULYrnwHmz8PNHITI4R2k0rb1PV4iefX:A20vTDBCNzJu513tRznrwHmz8tIM4rmM

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • UPX packed file 55 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 10 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5116
      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        3⤵
        • Checks computer location settings
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:2132
        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
          4⤵
            PID:1092
            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
              5⤵
                PID:4556
                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                  6⤵
                    PID:4996
                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                    6⤵
                      PID:5160
                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                      6⤵
                        PID:6588
                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                      5⤵
                        PID:116
                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                          6⤵
                            PID:5952
                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                          5⤵
                            PID:4316
                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                            5⤵
                              PID:5928
                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                            4⤵
                              PID:712
                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                5⤵
                                  PID:4284
                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                    6⤵
                                      PID:5980
                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                    5⤵
                                      PID:224
                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                      5⤵
                                        PID:6300
                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                      4⤵
                                        PID:1604
                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                          5⤵
                                            PID:5616
                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                          4⤵
                                            PID:324
                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                            4⤵
                                              PID:5964
                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                            3⤵
                                              PID:2272
                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                4⤵
                                                  PID:3892
                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                    5⤵
                                                      PID:2256
                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                      5⤵
                                                        PID:5248
                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                      4⤵
                                                        PID:556
                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                          5⤵
                                                            PID:6232
                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                          4⤵
                                                            PID:2776
                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                            4⤵
                                                              PID:5996
                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                            3⤵
                                                              PID:3824
                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                4⤵
                                                                  PID:4492
                                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                    5⤵
                                                                      PID:6692
                                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                    4⤵
                                                                      PID:984
                                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                      4⤵
                                                                        PID:6580
                                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                      3⤵
                                                                        PID:776
                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                          4⤵
                                                                            PID:5608
                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                          3⤵
                                                                            PID:4100
                                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                            3⤵
                                                                              PID:5700
                                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                            2⤵
                                                                            • Checks computer location settings
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4332
                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                              3⤵
                                                                                PID:1884
                                                                                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                  4⤵
                                                                                    PID:1300
                                                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                      5⤵
                                                                                        PID:468
                                                                                      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                        5⤵
                                                                                          PID:3088
                                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                          5⤵
                                                                                            PID:6468
                                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                          4⤵
                                                                                            PID:2308
                                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                              5⤵
                                                                                                PID:6096
                                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                              4⤵
                                                                                                PID:6104
                                                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                4⤵
                                                                                                  PID:1704
                                                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                3⤵
                                                                                                  PID:4512
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                    4⤵
                                                                                                      PID:4668
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                        5⤵
                                                                                                          PID:6596
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                        4⤵
                                                                                                          PID:3768
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                          4⤵
                                                                                                            PID:6308
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                          3⤵
                                                                                                            PID:4772
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                              4⤵
                                                                                                                PID:5200
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                4⤵
                                                                                                                  PID:6616
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                3⤵
                                                                                                                  PID:3356
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                  3⤵
                                                                                                                    PID:5600
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                  2⤵
                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                  PID:1224
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                    3⤵
                                                                                                                      PID:1984
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                        4⤵
                                                                                                                          PID:748
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                            5⤵
                                                                                                                              PID:5624
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                            4⤵
                                                                                                                              PID:3120
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                              4⤵
                                                                                                                                PID:5708
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                              3⤵
                                                                                                                                PID:3752
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                  4⤵
                                                                                                                                    PID:496
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                    4⤵
                                                                                                                                      PID:5480
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:4544
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:5540
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                      2⤵
                                                                                                                                        PID:2760
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:2056
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                              4⤵
                                                                                                                                                PID:2476
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                4⤵
                                                                                                                                                  PID:6292
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:3744
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5532
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2520
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1328
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:6284
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4848
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5364
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:6728

                                                                                                                                                          Network

                                                                                                                                                          • flag-us
                                                                                                                                                            DNS
                                                                                                                                                            146.78.124.51.in-addr.arpa
                                                                                                                                                            Remote address:
                                                                                                                                                            8.8.8.8:53
                                                                                                                                                            Request
                                                                                                                                                            146.78.124.51.in-addr.arpa
                                                                                                                                                            IN PTR
                                                                                                                                                            Response
                                                                                                                                                          No results found
                                                                                                                                                          • 8.8.8.8:53
                                                                                                                                                            146.78.124.51.in-addr.arpa
                                                                                                                                                            dns
                                                                                                                                                            72 B
                                                                                                                                                            158 B
                                                                                                                                                            1
                                                                                                                                                            1

                                                                                                                                                            DNS Request

                                                                                                                                                            146.78.124.51.in-addr.arpa

                                                                                                                                                          MITRE ATT&CK Enterprise v15

                                                                                                                                                          Replay Monitor

                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                          Downloads

                                                                                                                                                          • C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\chinese nude [free] (Sylvia,Tatjana).avi.exe

                                                                                                                                                            Filesize

                                                                                                                                                            1.2MB

                                                                                                                                                            MD5

                                                                                                                                                            3234e3a54bc2324355b3d881dd3f5c5c

                                                                                                                                                            SHA1

                                                                                                                                                            f6e84f86a551ac299a46ca70fe3db4680a9c5624

                                                                                                                                                            SHA256

                                                                                                                                                            bd60023df70a3293f1d6f433157b4aaa6c5b735b827a3cb16adf3972436bccc6

                                                                                                                                                            SHA512

                                                                                                                                                            828a9d54a431ef0281bfc6743640ea61b9efa14e8c4398ff889f4a555517bbdf61b2d4e1740f106801c84e543595f581376fcbafe752c468a151a8719946e7cb

                                                                                                                                                          • memory/116-41-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/224-108-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/324-74-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/468-53-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/496-85-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/712-20-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/748-37-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/776-36-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/984-102-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1092-30-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1092-14-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1224-23-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1300-45-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1604-42-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1704-83-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1884-13-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1884-27-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1984-34-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/1984-17-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2056-60-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2132-21-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2256-59-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2272-26-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2308-43-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2476-105-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2520-47-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2760-32-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/2776-79-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3120-70-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3356-67-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3744-64-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3752-31-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3768-99-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3824-38-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/3892-24-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4100-66-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4316-82-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4332-12-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4332-18-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4492-48-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4512-19-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4512-39-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4544-65-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4556-25-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4772-61-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4772-33-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4848-58-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/4996-57-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/5084-29-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/5084-0-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/5084-8-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/5084-6-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/5116-16-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          • memory/5160-112-0x0000000000400000-0x000000000041C000-memory.dmp

                                                                                                                                                            Filesize

                                                                                                                                                            112KB

                                                                                                                                                          We care about your privacy.

                                                                                                                                                          This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.