08aa02144c8b48aa7b1f94a3508472f3281b5bbb908cab49596f8ed9c3d20000

Analysis

max time kernel
25s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16/10/2023, 18:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
Size

1.2MB
MD5

4d91c02d2852b989865a35bf7548d7e0
SHA1

0b44e7553b7cb97cb0ebd9713bc8c131db3aae84
SHA256

08aa02144c8b48aa7b1f94a3508472f3281b5bbb908cab49596f8ed9c3d20000
SHA512

d6e4525aa62ac88a869265846e738f8681df3f93636109c3b6bd6f19f9bf85e2bcd74c238a889cdf09a77a0abc67ec5ffc971c89e7c386e7a07ce02bdd75c3b3
SSDEEP

24576:oWDvFI0+yQUVB7ppk7dH8RwVI/TOFowVitm3VvKAk:VLF33pWRGwiLOFT6Cl6

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\O:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\T:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\Z:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\A:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\B:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\H:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\I:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\V:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\G:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\K:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\L:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\N:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\P:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\R:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\U:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\W:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\X:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\Y:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\E:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\M:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\Q:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File opened (read-only)	\??\S:	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Update\Download\black fetish kicking [milf] (Liz,Tatjana).mpeg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files\Windows Journal\Templates\african lesbian beastiality hidden wifey .zip.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Google\Temp\american porn trambling licking black hairunshaved .rar.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\malaysia hardcore masturbation latex .mpg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\norwegian beast uncut .rar.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\norwegian trambling hot (!) (Samantha).zip.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files\DVD Maker\Shared\brasilian beastiality nude public (Melissa,Jenna).avi.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\sperm animal masturbation fishy .mpeg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\chinese xxx public hole leather (Sonja,Ashley).mpeg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\danish lingerie public hole hotel .mpg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\kicking lesbian .zip.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian xxx licking shower (Samantha,Sonja).mpeg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\handjob fetish hot (!) .zip.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\beast bukkake full movie high heels (Sarah,Sonja).mpeg.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2588	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
3048	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
3052	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1592	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
308	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
3024	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2588	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2572	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
832	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2104	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2124	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1956	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2600	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2812	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2816	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
3048	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2896	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2896	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1592	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1592	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1948	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1948	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1528	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1528	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1996	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
1996	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
3052	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
3052	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 2624	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	28
PID 2220 wrote to memory of 2624	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	28
PID 2220 wrote to memory of 2624	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	28
PID 2220 wrote to memory of 2624	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	28
PID 2624 wrote to memory of 2724	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	29
PID 2624 wrote to memory of 2724	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	29
PID 2624 wrote to memory of 2724	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	29
PID 2624 wrote to memory of 2724	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	29
PID 2220 wrote to memory of 2972	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	30
PID 2220 wrote to memory of 2972	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	30
PID 2220 wrote to memory of 2972	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	30
PID 2220 wrote to memory of 2972	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	30
PID 2624 wrote to memory of 1876	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	31
PID 2624 wrote to memory of 1876	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	31
PID 2624 wrote to memory of 1876	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	31
PID 2624 wrote to memory of 1876	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	31
PID 2724 wrote to memory of 2792	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	32
PID 2724 wrote to memory of 2792	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	32
PID 2724 wrote to memory of 2792	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	32
PID 2724 wrote to memory of 2792	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	32
PID 2972 wrote to memory of 2556	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	33
PID 2972 wrote to memory of 2556	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	33
PID 2972 wrote to memory of 2556	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	33
PID 2972 wrote to memory of 2556	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	33
PID 2220 wrote to memory of 2696	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	36
PID 2220 wrote to memory of 2696	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	36
PID 2220 wrote to memory of 2696	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	36
PID 2220 wrote to memory of 2696	2220	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	36
PID 1876 wrote to memory of 2588	1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	34
PID 1876 wrote to memory of 2588	1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	34
PID 1876 wrote to memory of 2588	1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	34
PID 1876 wrote to memory of 2588	1876	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	34
PID 2624 wrote to memory of 2640	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	35
PID 2624 wrote to memory of 2640	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	35
PID 2624 wrote to memory of 2640	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	35
PID 2624 wrote to memory of 2640	2624	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	35
PID 2556 wrote to memory of 3048	2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	38
PID 2556 wrote to memory of 3048	2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	38
PID 2556 wrote to memory of 3048	2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	38
PID 2556 wrote to memory of 3048	2556	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	38
PID 2792 wrote to memory of 3052	2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	37
PID 2792 wrote to memory of 3052	2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	37
PID 2792 wrote to memory of 3052	2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	37
PID 2792 wrote to memory of 3052	2792	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	37
PID 2696 wrote to memory of 308	2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	40
PID 2696 wrote to memory of 308	2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	40
PID 2696 wrote to memory of 308	2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	40
PID 2696 wrote to memory of 308	2696	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	40
PID 2724 wrote to memory of 1592	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	39
PID 2724 wrote to memory of 1592	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	39
PID 2724 wrote to memory of 1592	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	39
PID 2724 wrote to memory of 1592	2724	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	39
PID 2640 wrote to memory of 3024	2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	45
PID 2640 wrote to memory of 3024	2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	45
PID 2640 wrote to memory of 3024	2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	45
PID 2640 wrote to memory of 3024	2640	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	45
PID 2972 wrote to memory of 2572	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	44
PID 2972 wrote to memory of 2572	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	44
PID 2972 wrote to memory of 2572	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	44
PID 2972 wrote to memory of 2572	2972	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	44
PID 2588 wrote to memory of 832	2588	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	43
PID 2588 wrote to memory of 832	2588	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	43
PID 2588 wrote to memory of 832	2588	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	43
PID 2588 wrote to memory of 832	2588	NEAS.4d91c02d2852b989865a35bf7548d7e0.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:2236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        9⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        10⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        9⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        9⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:18436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:10528
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15632
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        9⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        9⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15420
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:18724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14516
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:17228
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:12272
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:16736
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15192
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15344
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:616
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15080
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14564
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16628
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14588
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14484
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15972
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:9848
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:15288
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:2828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:12192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14400
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15144
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15436
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:10972
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:2456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16004
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14344
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15008
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:12496
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:15304
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:308
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14536
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:12216
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14992
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15364
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14284
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14612
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:8756
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:14984
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:16012
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:14968
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15136
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:6704
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:12232
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  PID:1680
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
        5⤵
        
        PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15656
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:16704
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:10980
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  PID:1384
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15168
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:7980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:14856
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
      4⤵
      PID:15956
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:15016
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  PID:6352
- - C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
    3⤵
    PID:15876
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  PID:10520
- C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.4d91c02d2852b989865a35bf7548d7e0.exe"
  2⤵
  PID:17012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\kicking lesbian .zip.exe

Filesize
632KB

MD5
b2a9e417da425385db3885c765126685

SHA1
1950f846085642a3ecddc5fadabda08d0fef76fc

SHA256
944e9088bb2a393dab3746173ff35a4bb3e9550a264435ddfe63d2d66e095ea6

SHA512
9ed80997e1e79adc19ea3db9a0ef6b4062588aa921b79b5537f91b76621ff3df5184dd95c9f51f2b32dd9fbe9a38073e2e0f5aa5a08be0473aa62a7522805c2f

Download Submit