4f57dc707475943a6e9c0db393d0b9d90735812851e21ec3fa435125a7fb409a

Analysis

max time kernel
56s
max time network
149s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 20:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c17f90cf849b28c457ef582ef84be940.exe
Size

157KB
MD5

c17f90cf849b28c457ef582ef84be940
SHA1

89b3e7b52b3009e12a4bd2c3ad0b40bbc1dc1177
SHA256

4f57dc707475943a6e9c0db393d0b9d90735812851e21ec3fa435125a7fb409a
SHA512

d77d5f9b5cec7f9f1e193cf48acbdf165f41b2527b68c70d42a58f8507b1c4147fa546dba101ef8c7c3582818fc6c5da3e041d7ace9596b57f0bbd5cea4ce847
SSDEEP

3072:gjbLl/gvQoutp1Tj4mYWR/RQs9pqA+V4hFhDHHlAEe:gjluQoS3Io5Rh9f+V4hnHHe

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 54 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2224-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2224-2-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2224-3-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2292-5-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2292-7-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2660-9-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/840-10-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2704-13-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2224-14-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2920-15-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2628-17-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2496-18-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2928-19-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2152-20-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2660-21-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2580-22-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2612-23-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2704-24-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2628-27-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2172-26-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2492-28-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2512-29-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2184-30-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2580-32-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2396-33-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1892-34-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2172-35-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2424-39-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1880-41-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1300-44-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/592-43-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/536-46-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1080-47-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2224-48-0x0000000004920000-0x0000000004940000-memory.dmp	upx
behavioral1/memory/1884-49-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2716-51-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2528-52-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1776-53-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/268-54-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1672-55-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1196-57-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1432-59-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1756-60-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/952-62-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/528-63-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3036-64-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2960-65-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1748-66-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/772-67-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1464-68-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2644-69-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2044-71-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2224-76-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2208-77-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.c17f90cf849b28c457ef582ef84be940.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\Z:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\H:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\J:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\K:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\N:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\P:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\S:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\T:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\U:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\E:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\G:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\I:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\O:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\Q:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\Y:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\A:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\B:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\L:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\M:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\V:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\W:	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File opened (read-only)	\??\X:	NEAS.c17f90cf849b28c457ef582ef84be940.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\gang bang masturbation boots (Janette).zip.exe	NEAS.c17f90cf849b28c457ef582ef84be940.exe
File created	C:\Program Files\Common Files\Microsoft Shared\russian kicking [milf] blondie (Ashley).rar.exe	NEAS.c17f90cf849b28c457ef582ef84be940.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.c17f90cf849b28c457ef582ef84be940.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe
840	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe
840	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2704	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2496	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2628	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2152	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe
840	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2492	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2512	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2580	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2396	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1892	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2704	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2172	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2184	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1880	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2424	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2496	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2628	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1300	NEAS.c17f90cf849b28c457ef582ef84be940.exe
592	NEAS.c17f90cf849b28c457ef582ef84be940.exe
536	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe
840	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1080	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1884	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2152	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2716	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2528	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1776	NEAS.c17f90cf849b28c457ef582ef84be940.exe
268	NEAS.c17f90cf849b28c457ef582ef84be940.exe
268	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1776	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1672	NEAS.c17f90cf849b28c457ef582ef84be940.exe
1672	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2492	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2492	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2512	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2512	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe
2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2292	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	29
PID 2224 wrote to memory of 2292	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	29
PID 2224 wrote to memory of 2292	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	29
PID 2224 wrote to memory of 2292	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	29
PID 2292 wrote to memory of 840	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	30
PID 2292 wrote to memory of 840	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	30
PID 2292 wrote to memory of 840	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	30
PID 2292 wrote to memory of 840	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	30
PID 2224 wrote to memory of 2920	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	31
PID 2224 wrote to memory of 2920	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	31
PID 2224 wrote to memory of 2920	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	31
PID 2224 wrote to memory of 2920	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	31
PID 2292 wrote to memory of 2928	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	32
PID 2292 wrote to memory of 2928	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	32
PID 2292 wrote to memory of 2928	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	32
PID 2292 wrote to memory of 2928	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	32
PID 840 wrote to memory of 2660	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	33
PID 840 wrote to memory of 2660	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	33
PID 840 wrote to memory of 2660	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	33
PID 840 wrote to memory of 2660	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	33
PID 2224 wrote to memory of 2612	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	34
PID 2224 wrote to memory of 2612	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	34
PID 2224 wrote to memory of 2612	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	34
PID 2224 wrote to memory of 2612	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	34
PID 2920 wrote to memory of 2704	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	35
PID 2920 wrote to memory of 2704	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	35
PID 2920 wrote to memory of 2704	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	35
PID 2920 wrote to memory of 2704	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	35
PID 2928 wrote to memory of 2628	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	36
PID 2928 wrote to memory of 2628	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	36
PID 2928 wrote to memory of 2628	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	36
PID 2928 wrote to memory of 2628	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	36
PID 2292 wrote to memory of 2496	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	37
PID 2292 wrote to memory of 2496	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	37
PID 2292 wrote to memory of 2496	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	37
PID 2292 wrote to memory of 2496	2292	NEAS.c17f90cf849b28c457ef582ef84be940.exe	37
PID 2660 wrote to memory of 2152	2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe	38
PID 2660 wrote to memory of 2152	2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe	38
PID 2660 wrote to memory of 2152	2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe	38
PID 2660 wrote to memory of 2152	2660	NEAS.c17f90cf849b28c457ef582ef84be940.exe	38
PID 2612 wrote to memory of 2492	2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe	40
PID 2612 wrote to memory of 2492	2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe	40
PID 2612 wrote to memory of 2492	2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe	40
PID 2612 wrote to memory of 2492	2612	NEAS.c17f90cf849b28c457ef582ef84be940.exe	40
PID 840 wrote to memory of 2512	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	39
PID 840 wrote to memory of 2512	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	39
PID 840 wrote to memory of 2512	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	39
PID 840 wrote to memory of 2512	840	NEAS.c17f90cf849b28c457ef582ef84be940.exe	39
PID 2224 wrote to memory of 2580	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	41
PID 2224 wrote to memory of 2580	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	41
PID 2224 wrote to memory of 2580	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	41
PID 2224 wrote to memory of 2580	2224	NEAS.c17f90cf849b28c457ef582ef84be940.exe	41
PID 2920 wrote to memory of 2396	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	42
PID 2920 wrote to memory of 2396	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	42
PID 2920 wrote to memory of 2396	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	42
PID 2920 wrote to memory of 2396	2920	NEAS.c17f90cf849b28c457ef582ef84be940.exe	42
PID 2704 wrote to memory of 1892	2704	NEAS.c17f90cf849b28c457ef582ef84be940.exe	43
PID 2704 wrote to memory of 1892	2704	NEAS.c17f90cf849b28c457ef582ef84be940.exe	43
PID 2704 wrote to memory of 1892	2704	NEAS.c17f90cf849b28c457ef582ef84be940.exe	43
PID 2704 wrote to memory of 1892	2704	NEAS.c17f90cf849b28c457ef582ef84be940.exe	43
PID 2928 wrote to memory of 2172	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	44
PID 2928 wrote to memory of 2172	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	44
PID 2928 wrote to memory of 2172	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	44
PID 2928 wrote to memory of 2172	2928	NEAS.c17f90cf849b28c457ef582ef84be940.exe	44

C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6876
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:340
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6956
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3764
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6756
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6608
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:7060
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6780
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6728
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:3632
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6720
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4508
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6672
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6616
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:6828
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6640
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4756
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6804
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:6472
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
        5⤵
        
        PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6512
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
      4⤵
      PID:6740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:4296
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:6860
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:3856
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:6528
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
    3⤵
    PID:6932
- C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c17f90cf849b28c457ef582ef84be940.exe"
  2⤵
  PID:6536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-54-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/528-63-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/536-46-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/592-43-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/772-67-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/840-45-0x00000000045D0000-0x00000000045F0000-memory.dmp

Filesize
128KB

Download
memory/840-8-0x00000000045C0000-0x00000000045E0000-memory.dmp

Filesize
128KB

Download
memory/840-10-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/952-62-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1080-47-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1196-57-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1300-44-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1432-59-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1464-68-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1672-55-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1748-66-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1756-60-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1776-53-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1880-41-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1884-49-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1892-34-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2044-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2152-20-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2172-35-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2172-26-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2184-30-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2208-77-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-48-0x0000000004920000-0x0000000004940000-memory.dmp

Filesize
128KB

Download
memory/2224-3-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-2-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-14-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-76-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2224-12-0x0000000004920000-0x0000000004940000-memory.dmp

Filesize
128KB

Download
memory/2292-36-0x0000000004510000-0x0000000004530000-memory.dmp

Filesize
128KB

Download
memory/2292-6-0x0000000000780000-0x00000000007A0000-memory.dmp

Filesize
128KB

Download
memory/2292-5-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2292-16-0x0000000000780000-0x00000000007A0000-memory.dmp

Filesize
128KB

Download
memory/2292-25-0x0000000000780000-0x00000000007A0000-memory.dmp

Filesize
128KB

Download
memory/2292-7-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2396-33-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2424-39-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2492-28-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2496-40-0x00000000045C0000-0x00000000045E0000-memory.dmp

Filesize
128KB

Download
memory/2496-18-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2512-29-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2512-42-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/2528-52-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2580-32-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2580-22-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2612-23-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2628-37-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/2628-56-0x0000000004910000-0x0000000004930000-memory.dmp

Filesize
128KB

Download
memory/2628-27-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2628-31-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/2628-17-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2644-69-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2660-21-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2660-9-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2704-13-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2704-24-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2716-51-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2920-11-0x0000000004900000-0x0000000004920000-memory.dmp

Filesize
128KB

Download
memory/2920-15-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2920-72-0x0000000004920000-0x0000000004940000-memory.dmp

Filesize
128KB

Download
memory/2928-19-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3036-64-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download