f3ecf5536312e25694fedcc68c1359225933cd97c386b97e17492385433758ca

Analysis

max time kernel
17s
max time network
130s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
Size

1.3MB
MD5

9a7f06c085aef64f453a4e4b30b9a240
SHA1

28987a6d2a3c35a101fcfdb450f372e0b366da9d
SHA256

f3ecf5536312e25694fedcc68c1359225933cd97c386b97e17492385433758ca
SHA512

bb1ae59791a89f1c90c8ce54c2f6c05eb7d78d741233fc3f0aea3d4b0316842e71a8c97fc743bbc1375d7c05981a64244f9c5e57df67e3fd6d5b0a8b3d5e839b
SSDEEP

24576:lq8PtaYffeWlRQLw3MP9BP7j6aIy7tQdr9UDVNBfqRuzTxlNsQWmoaE:VrwPsxd5UpNYRuzFlNs1ft

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\K:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\M:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\O:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\V:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\Z:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\S:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\T:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\B:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\E:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\H:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\P:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\Q:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\R:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\W:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\X:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\Y:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\A:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\I:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\J:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\L:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\N:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File opened (read-only)	\??\U:	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\Templates\spanish gay lingerie masturbation ash castration .zip.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\porn [bangbus] mistress (Tatjana,Karin).rar.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\asian fetish gang bang masturbation .mpeg.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\american horse action uncut titts fishy (Britney,Melissa).mpg.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File created	C:\Program Files\Common Files\Microsoft Shared\lingerie full movie high heels (Britney).rar.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
File created	C:\Program Files\DVD Maker\Shared\beastiality fetish several models .rar.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2884	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2712	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2720	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2492	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2476	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2468	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2496	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
3004	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
1636	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
1076	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2712	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2884	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2940	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2952	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2492	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
2720	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2364	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	28
PID 924 wrote to memory of 2364	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	28
PID 924 wrote to memory of 2364	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	28
PID 924 wrote to memory of 2364	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	28
PID 924 wrote to memory of 2328	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	29
PID 924 wrote to memory of 2328	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	29
PID 924 wrote to memory of 2328	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	29
PID 924 wrote to memory of 2328	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	29
PID 2364 wrote to memory of 2588	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	30
PID 2364 wrote to memory of 2588	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	30
PID 2364 wrote to memory of 2588	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	30
PID 2364 wrote to memory of 2588	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	30
PID 2364 wrote to memory of 2884	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	34
PID 2364 wrote to memory of 2884	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	34
PID 2364 wrote to memory of 2884	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	34
PID 2364 wrote to memory of 2884	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	34
PID 2328 wrote to memory of 2720	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	33
PID 2328 wrote to memory of 2720	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	33
PID 2328 wrote to memory of 2720	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	33
PID 2328 wrote to memory of 2720	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	33
PID 2588 wrote to memory of 2712	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	31
PID 2588 wrote to memory of 2712	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	31
PID 2588 wrote to memory of 2712	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	31
PID 2588 wrote to memory of 2712	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	31
PID 924 wrote to memory of 2492	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	32
PID 924 wrote to memory of 2492	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	32
PID 924 wrote to memory of 2492	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	32
PID 924 wrote to memory of 2492	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	32
PID 2588 wrote to memory of 2476	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	35
PID 2588 wrote to memory of 2476	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	35
PID 2588 wrote to memory of 2476	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	35
PID 2588 wrote to memory of 2476	2588	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	35
PID 2712 wrote to memory of 2468	2712	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	36
PID 2712 wrote to memory of 2468	2712	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	36
PID 2712 wrote to memory of 2468	2712	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	36
PID 2712 wrote to memory of 2468	2712	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	36
PID 2884 wrote to memory of 2496	2884	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	37
PID 2884 wrote to memory of 2496	2884	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	37
PID 2884 wrote to memory of 2496	2884	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	37
PID 2884 wrote to memory of 2496	2884	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	37
PID 2328 wrote to memory of 3004	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	38
PID 2328 wrote to memory of 3004	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	38
PID 2328 wrote to memory of 3004	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	38
PID 2328 wrote to memory of 3004	2328	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	38
PID 2364 wrote to memory of 1076	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	39
PID 2364 wrote to memory of 1076	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	39
PID 2364 wrote to memory of 1076	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	39
PID 2364 wrote to memory of 1076	2364	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	39
PID 924 wrote to memory of 1636	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	40
PID 924 wrote to memory of 1636	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	40
PID 924 wrote to memory of 1636	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	40
PID 924 wrote to memory of 1636	924	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	40
PID 2492 wrote to memory of 2952	2492	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	41
PID 2492 wrote to memory of 2952	2492	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	41
PID 2492 wrote to memory of 2952	2492	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	41
PID 2492 wrote to memory of 2952	2492	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	41
PID 2720 wrote to memory of 2940	2720	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	42
PID 2720 wrote to memory of 2940	2720	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	42
PID 2720 wrote to memory of 2940	2720	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	42
PID 2720 wrote to memory of 2940	2720	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	42
PID 2476 wrote to memory of 2772	2476	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	43
PID 2476 wrote to memory of 2772	2476	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	43
PID 2476 wrote to memory of 2772	2476	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	43
PID 2476 wrote to memory of 2772	2476	NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        8⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        8⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        8⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:1160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:2540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:6156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        7⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3836
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:9264
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:7676
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:6112
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:3896
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:6176
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:7764
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:1836
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4884
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:4656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:10080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5420
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:10180
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:9232
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:5684
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:9728
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        6⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
        5⤵
        
        PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:8668
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:1820
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:7488
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:8020
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:6900
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:7728
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:9452
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
      4⤵
      PID:9256
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:4016
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:6920
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:10156
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:4868
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:8728
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  PID:1540
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
    3⤵
    PID:8008
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  PID:3916
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  PID:6264
- C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.9a7f06c085aef64f453a4e4b30b9a240.exe"
  2⤵
  PID:10020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\porn [bangbus] mistress (Tatjana,Karin).rar.exe

Filesize
1.8MB

MD5
4437ce4e85cc1ff3838571e1301c1c5b

SHA1
e2958d20086351f728864878bffd66ce02b69ebe

SHA256
185eca2a708fe99c06a277cf7ce95bf97037d094664cdfeaddf86967699643a9

SHA512
21c29399cdb6b57782cac83862861d6a50d331ed619cb4a2352e42f76ccbe00a114e27dad0706f8a64f2cef1cf275845524543d72a0e19ac37949bd8c3762e81

Download Submit
memory/752-56-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/924-16-0x0000000004BA0000-0x0000000004BBC000-memory.dmp

Filesize
112KB

Download
memory/924-5-0x0000000004BA0000-0x0000000004BBC000-memory.dmp

Filesize
112KB

Download
memory/924-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/924-8-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/924-19-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/924-3-0x0000000004B90000-0x0000000004BAC000-memory.dmp

Filesize
112KB

Download
memory/924-38-0x0000000004BB0000-0x0000000004BCC000-memory.dmp

Filesize
112KB

Download
memory/924-27-0x0000000004BB0000-0x0000000004BCC000-memory.dmp

Filesize
112KB

Download
memory/1076-39-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1108-60-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1220-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1472-55-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1612-54-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1624-57-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1636-40-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1820-59-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1996-50-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2328-18-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2328-47-0x00000000045E0000-0x00000000045FC000-memory.dmp

Filesize
112KB

Download
memory/2328-6-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2328-35-0x00000000045D0000-0x00000000045EC000-memory.dmp

Filesize
112KB

Download
memory/2364-20-0x0000000004A50000-0x0000000004A6C000-memory.dmp

Filesize
112KB

Download
memory/2364-49-0x0000000004A60000-0x0000000004A7C000-memory.dmp

Filesize
112KB

Download
memory/2364-14-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2364-10-0x0000000004A50000-0x0000000004A6C000-memory.dmp

Filesize
112KB

Download
memory/2364-7-0x0000000004A40000-0x0000000004A5C000-memory.dmp

Filesize
112KB

Download
memory/2364-36-0x0000000004A60000-0x0000000004A7C000-memory.dmp

Filesize
112KB

Download
memory/2452-51-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2468-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2476-31-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2476-43-0x0000000004910000-0x000000000492C000-memory.dmp

Filesize
112KB

Download
memory/2492-25-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2492-30-0x00000000047D0000-0x00000000047EC000-memory.dmp

Filesize
112KB

Download
memory/2496-34-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2496-21-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2588-9-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2588-17-0x0000000004910000-0x000000000492C000-memory.dmp

Filesize
112KB

Download
memory/2588-29-0x0000000004910000-0x000000000492C000-memory.dmp

Filesize
112KB

Download
memory/2712-12-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2712-24-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2720-26-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2720-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2724-45-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2748-52-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2772-44-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2796-48-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2824-53-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2856-58-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2884-23-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2884-11-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2940-42-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2952-41-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3004-37-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download