7f2ca17a538a5c3c43c00921ea13d34d119346689940e743e398e75caf2a93f2

Analysis

max time kernel
16s
max time network
124s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 21:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.f82dc1430efc4b523b50ae3933299f20.exe
Size

231KB
MD5

f82dc1430efc4b523b50ae3933299f20
SHA1

8f27403cf9810deea0184c23e2d072b82c2bbf9b
SHA256

7f2ca17a538a5c3c43c00921ea13d34d119346689940e743e398e75caf2a93f2
SHA512

e7d89f68f0fe7045ea5e9cfe711e6e164223c8fddf43b0179fe77df4c584aaa3ebaad741822b8566beede55fc02b91e389e23c50fecc5c841ecae3f6c2b99588
SSDEEP

6144:aDOxZXPIo5R4nM/40yJy9lDqpKomW5ESQxYxa7hZkUMD:lXpqhyTGy2uQXD

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 22 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-0-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2104-4-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/files/0x0007000000015dc1-6.dat	upx
behavioral1/memory/2192-37-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2160-59-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2292-60-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/3024-61-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2716-62-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2104-63-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/3016-68-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1744-71-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1940-72-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1748-73-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1832-70-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/3064-67-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/1516-74-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2844-76-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/320-77-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2808-75-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2192-78-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2492-81-0x0000000000400000-0x000000000041B000-memory.dmp	upx
behavioral1/memory/2008-83-0x0000000000400000-0x000000000041B000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.f82dc1430efc4b523b50ae3933299f20.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\H:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\M:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\Q:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\S:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\Y:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\Z:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\A:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\G:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\I:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\J:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\K:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\N:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\O:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\P:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\U:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\X:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\E:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\L:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\R:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\T:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\V:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File opened (read-only)	\??\W:	NEAS.f82dc1430efc4b523b50ae3933299f20.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\russian animal bukkake uncut castration .avi.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\bukkake full movie feet .mpg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\american animal trambling hidden (Melissa).mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\russian nude bukkake hidden cock pregnant (Melissa).mpg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\russian gang bang hardcore uncut feet ash (Melissa).mpg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\indian cum sperm [bangbus] feet .avi.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\blowjob licking .mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files\Common Files\Microsoft Shared\xxx hot (!) mature .mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files\Windows Journal\Templates\fucking hot (!) titts .avi.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\trambling voyeur lady .mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\bukkake public (Melissa).mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\bukkake lesbian .mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Google\Temp\black beastiality gay several models .mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Google\Update\Download\indian animal lesbian big titts .zip.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\hardcore voyeur feet bondage .mpg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\sperm lesbian pregnant .mpg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\danish animal beast full movie titts (Britney,Curtney).avi.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\black horse lesbian masturbation young .avi.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\mssrv.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\xxx [free] cock .rar.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese beastiality hardcore [bangbus] titts shower .mpeg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lesbian sleeping cock sweet (Karin).rar.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\indian porn lesbian catfight cock .mpg.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\bukkake masturbation titts mature .rar.exe	NEAS.f82dc1430efc4b523b50ae3933299f20.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
3024	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2160	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2716	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
3016	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
3064	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1744	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1832	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1940	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1748	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
320	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1516	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
3024	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2716	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2160	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2492	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2008	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2424	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
3064	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1252	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
3016	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2956	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2072	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2728	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2740	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1988	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1744	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1832	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2336	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
892	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1816	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2436	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2436	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2440	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
2440	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
320	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
320	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1748	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1748	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1940	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
1940	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
672	NEAS.f82dc1430efc4b523b50ae3933299f20.exe
672	NEAS.f82dc1430efc4b523b50ae3933299f20.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2104	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	28
PID 2192 wrote to memory of 2104	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	28
PID 2192 wrote to memory of 2104	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	28
PID 2192 wrote to memory of 2104	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	28
PID 2104 wrote to memory of 2808	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	29
PID 2104 wrote to memory of 2808	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	29
PID 2104 wrote to memory of 2808	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	29
PID 2104 wrote to memory of 2808	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	29
PID 2192 wrote to memory of 2844	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	30
PID 2192 wrote to memory of 2844	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	30
PID 2192 wrote to memory of 2844	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	30
PID 2192 wrote to memory of 2844	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	30
PID 2808 wrote to memory of 2292	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	31
PID 2808 wrote to memory of 2292	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	31
PID 2808 wrote to memory of 2292	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	31
PID 2808 wrote to memory of 2292	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	31
PID 2192 wrote to memory of 3024	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	34
PID 2192 wrote to memory of 3024	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	34
PID 2192 wrote to memory of 3024	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	34
PID 2192 wrote to memory of 3024	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	34
PID 2844 wrote to memory of 2160	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	32
PID 2844 wrote to memory of 2160	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	32
PID 2844 wrote to memory of 2160	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	32
PID 2844 wrote to memory of 2160	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	32
PID 2104 wrote to memory of 2716	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	33
PID 2104 wrote to memory of 2716	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	33
PID 2104 wrote to memory of 2716	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	33
PID 2104 wrote to memory of 2716	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	33
PID 2808 wrote to memory of 3016	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	35
PID 2808 wrote to memory of 3016	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	35
PID 2808 wrote to memory of 3016	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	35
PID 2808 wrote to memory of 3016	2808	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	35
PID 2192 wrote to memory of 3064	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	36
PID 2192 wrote to memory of 3064	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	36
PID 2192 wrote to memory of 3064	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	36
PID 2192 wrote to memory of 3064	2192	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	36
PID 2292 wrote to memory of 1744	2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	37
PID 2292 wrote to memory of 1744	2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	37
PID 2292 wrote to memory of 1744	2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	37
PID 2292 wrote to memory of 1744	2292	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	37
PID 2844 wrote to memory of 1832	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	38
PID 2844 wrote to memory of 1832	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	38
PID 2844 wrote to memory of 1832	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	38
PID 2844 wrote to memory of 1832	2844	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	38
PID 2104 wrote to memory of 1940	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	39
PID 2104 wrote to memory of 1940	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	39
PID 2104 wrote to memory of 1940	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	39
PID 2104 wrote to memory of 1940	2104	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	39
PID 2160 wrote to memory of 1516	2160	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	40
PID 2160 wrote to memory of 1516	2160	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	40
PID 2160 wrote to memory of 1516	2160	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	40
PID 2160 wrote to memory of 1516	2160	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	40
PID 2716 wrote to memory of 320	2716	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	42
PID 2716 wrote to memory of 320	2716	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	42
PID 2716 wrote to memory of 320	2716	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	42
PID 2716 wrote to memory of 320	2716	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	42
PID 3024 wrote to memory of 1748	3024	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	41
PID 3024 wrote to memory of 1748	3024	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	41
PID 3024 wrote to memory of 1748	3024	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	41
PID 3024 wrote to memory of 1748	3024	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	41
PID 3016 wrote to memory of 2492	3016	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	43
PID 3016 wrote to memory of 2492	3016	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	43
PID 3016 wrote to memory of 2492	3016	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	43
PID 3016 wrote to memory of 2492	3016	NEAS.f82dc1430efc4b523b50ae3933299f20.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        9⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:13012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:108
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:16784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:11180
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9652
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:2800
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12580
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:16752
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4184
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9660
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:10952
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:16796
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9040
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12828
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:7724
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:12596
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13132
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:10264
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:1504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16820
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12924
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:2696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:16672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12860
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16728
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9628
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:13372
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12764
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:7740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:12572
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9456
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4244
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12932
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:17968
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:7304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12964
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:6080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:8696
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:13544
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:2132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        7⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:8156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12788
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:8176
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12684
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:13068
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:10832
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12588
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:11172
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2424
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        6⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9288
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:12772
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9636
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:10748
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:10816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:11156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:16828
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:9432
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12644
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:15376
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:10464
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  PID:3324
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
      4⤵
      PID:12748
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:9008
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
    3⤵
    PID:12884
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  PID:7124
- C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.f82dc1430efc4b523b50ae3933299f20.exe"
  2⤵
  PID:9644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\bukkake lesbian .mpeg.exe

Filesize
233KB

MD5
08bf2131de4509e6106a154139d215e5

SHA1
41bf447bc9b5a4e831f5d690986687b589058d72

SHA256
b24b66e6ffbcc3f7b2cb344e7ab31fb206a950a79231c9045d3ac68499fe64a3

SHA512
31d036fc22cf8a17734a7ae8151fdeecb5043a77eebd874db7851423939efd417ab027bd06fb7ebbcb5ada8bd8b30160b66268a3e5dfe299c06baeb872500e4e

Download Submit
memory/320-77-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1516-74-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1744-71-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1748-73-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1832-70-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/1940-72-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2008-83-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2104-63-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2104-4-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2160-59-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2192-18-0x0000000004D20000-0x0000000004D3B000-memory.dmp

Filesize
108KB

Download
memory/2192-37-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2192-69-0x0000000004D20000-0x0000000004D3B000-memory.dmp

Filesize
108KB

Download
memory/2192-80-0x0000000004D20000-0x0000000004D3B000-memory.dmp

Filesize
108KB

Download
memory/2192-0-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2192-56-0x0000000004D20000-0x0000000004D3B000-memory.dmp

Filesize
108KB

Download
memory/2192-55-0x0000000004680000-0x000000000469B000-memory.dmp

Filesize
108KB

Download
memory/2192-78-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2292-60-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2492-81-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2716-62-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2808-66-0x00000000045D0000-0x00000000045EB000-memory.dmp

Filesize
108KB

Download
memory/2808-82-0x0000000004580000-0x000000000459B000-memory.dmp

Filesize
108KB

Download
memory/2808-75-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2844-57-0x0000000001E50000-0x0000000001E6B000-memory.dmp

Filesize
108KB

Download
memory/2844-76-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2844-79-0x0000000001E50000-0x0000000001E6B000-memory.dmp

Filesize
108KB

Download
memory/3016-68-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3024-61-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/3064-67-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download