cbaf69969689d310a9a5f2d69862cada5ac11910946375e4995e6fbf1939a7cd

Analysis

max time kernel
22s
max time network
131s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
01/11/2023, 14:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
Size

1.8MB
MD5

c9b9d9a1b8def6b02ed9ddad9baba4c0
SHA1

65edaef6b9997873e913581db6912db74b16c8e5
SHA256

cbaf69969689d310a9a5f2d69862cada5ac11910946375e4995e6fbf1939a7cd
SHA512

8b8a9dfb3c708db61e5a0ca8f7e0bfb24c17765e109234d446cfceaf0e5ac57d683d9f45a4d876d112f7c5f30c985e6ba210aed257a01a5dc653c206ce40e431
SSDEEP

49152:Na0b26eHVNoT05oDZna0w+yDXCtuvsrZDOm+RanrJmj:NaaFeHV+qoDdHymtYQtmj

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1516-0-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/files/0x0008000000015c5f-5.dat	upx
behavioral1/memory/1516-9-0x0000000004BB0000-0x0000000004BCE000-memory.dmp	upx
behavioral1/memory/2788-10-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1516-46-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3020-50-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3060-49-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2788-54-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2580-55-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2592-56-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2232-57-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2592-59-0x0000000000820000-0x000000000083E000-memory.dmp	upx
behavioral1/memory/3060-61-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/3020-62-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2580-63-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/1628-66-0x0000000000400000-0x000000000041E000-memory.dmp	upx
behavioral1/memory/2592-65-0x0000000001E80000-0x0000000001E9E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\I:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\L:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\N:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\Q:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\R:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\Y:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\G:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\H:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\J:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\O:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\U:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\V:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\W:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\X:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\B:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\E:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\K:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\P:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\S:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\Z:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\M:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File opened (read-only)	\??\T:	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\trambling uncut shoes .mpeg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\tyrkish lesbian several models feet mistress (Sonja,Anniston).mpg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Google\Temp\black trambling hidden ìï .avi.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\american beastiality porn hot (!) upskirt .rar.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian fetish hidden vagina shoes .zip.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files\Windows Journal\Templates\beast xxx [milf] hole leather .mpeg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\italian fucking fucking catfight .rar.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\cumshot licking vagina (Jenna).mpg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\sperm porn girls high heels .mpeg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files\DVD Maker\Shared\indian porn catfight feet ejaculation (Anniston,Britney).mpeg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\swedish nude girls (Sandy).mpeg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Google\Update\Download\fetish cumshot big pregnant .mpg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\hardcore fetish big vagina latex .zip.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\cumshot gay catfight legs (Jenna).mpeg.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\german animal public upskirt .rar.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2924	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2888	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2584	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2604	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
884	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1028	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
488	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1044	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
476	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1628	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1844	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2924	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2888	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1148	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3028	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2388	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2552	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2080	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1496	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2972	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2604	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2096	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2584	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1800	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2368	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2416	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
832	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
400	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
488	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1044	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1028	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
884	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
1536	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2788	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	28
PID 1516 wrote to memory of 2788	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	28
PID 1516 wrote to memory of 2788	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	28
PID 1516 wrote to memory of 2788	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	28
PID 1516 wrote to memory of 3020	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	30
PID 1516 wrote to memory of 3020	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	30
PID 1516 wrote to memory of 3020	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	30
PID 1516 wrote to memory of 3020	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	30
PID 2788 wrote to memory of 3060	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	29
PID 2788 wrote to memory of 3060	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	29
PID 2788 wrote to memory of 3060	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	29
PID 2788 wrote to memory of 3060	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	29
PID 3020 wrote to memory of 2580	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	32
PID 3020 wrote to memory of 2580	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	32
PID 3020 wrote to memory of 2580	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	32
PID 3020 wrote to memory of 2580	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	32
PID 3060 wrote to memory of 2592	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	31
PID 3060 wrote to memory of 2592	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	31
PID 3060 wrote to memory of 2592	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	31
PID 3060 wrote to memory of 2592	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	31
PID 2788 wrote to memory of 2232	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	33
PID 2788 wrote to memory of 2232	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	33
PID 2788 wrote to memory of 2232	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	33
PID 2788 wrote to memory of 2232	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	33
PID 1516 wrote to memory of 1068	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	34
PID 1516 wrote to memory of 1068	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	34
PID 1516 wrote to memory of 1068	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	34
PID 1516 wrote to memory of 1068	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	34
PID 2592 wrote to memory of 2924	2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	35
PID 2592 wrote to memory of 2924	2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	35
PID 2592 wrote to memory of 2924	2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	35
PID 2592 wrote to memory of 2924	2592	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	35
PID 2580 wrote to memory of 2888	2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	36
PID 2580 wrote to memory of 2888	2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	36
PID 2580 wrote to memory of 2888	2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	36
PID 2580 wrote to memory of 2888	2580	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	36
PID 3020 wrote to memory of 2604	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	38
PID 3020 wrote to memory of 2604	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	38
PID 3020 wrote to memory of 2604	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	38
PID 3020 wrote to memory of 2604	3020	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	38
PID 3060 wrote to memory of 2584	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	37
PID 3060 wrote to memory of 2584	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	37
PID 3060 wrote to memory of 2584	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	37
PID 3060 wrote to memory of 2584	3060	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	37
PID 1516 wrote to memory of 488	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	42
PID 1516 wrote to memory of 488	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	42
PID 1516 wrote to memory of 488	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	42
PID 1516 wrote to memory of 488	1516	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	42
PID 2788 wrote to memory of 884	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	39
PID 2788 wrote to memory of 884	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	39
PID 2788 wrote to memory of 884	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	39
PID 2788 wrote to memory of 884	2788	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	39
PID 1068 wrote to memory of 1044	1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	41
PID 1068 wrote to memory of 1044	1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	41
PID 1068 wrote to memory of 1044	1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	41
PID 1068 wrote to memory of 1044	1068	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	41
PID 2232 wrote to memory of 1028	2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	40
PID 2232 wrote to memory of 1028	2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	40
PID 2232 wrote to memory of 1028	2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	40
PID 2232 wrote to memory of 1028	2232	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	40
PID 2924 wrote to memory of 476	2924	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	43
PID 2924 wrote to memory of 476	2924	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	43
PID 2924 wrote to memory of 476	2924	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	43
PID 2924 wrote to memory of 476	2924	NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:476
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        10⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1844
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:1660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13132
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13448
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:2760
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3848
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13220
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12568
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:15200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12332
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13100
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13624
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12428
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:14972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13664
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:11704
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13040
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13252
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:13140
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        9⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2348
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:11648
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:14064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:1540
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13260
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12548
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13584
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12816
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13640
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:11148
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:14700
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:13840
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        7⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:14964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13228
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13784
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2648
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:14552
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:15128
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:2256
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12560
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12208
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2272
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:15144
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:11608
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:488
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:13364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12600
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        6⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13480
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12248
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13456
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:15168
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:12388
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2552
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13824
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13680
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12436
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:2228
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:14328
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  PID:2956
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:12908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
        5⤵
        
        PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13328
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:12976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:12840
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
      4⤵
      PID:13904
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:8224
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:12680
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  PID:4616
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:12144
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  PID:7684
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
    3⤵
    PID:12988
- C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c9b9d9a1b8def6b02ed9ddad9baba4c0.exe"
  2⤵
  PID:14708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\trambling uncut shoes .mpeg.exe

Filesize
2.0MB

MD5
a472af93d2841f741744d35a15b1914e

SHA1
8814fb21018f82bcbbe38335d314787a89591a59

SHA256
201fc468289aa40dfde6a152279556283da042fd155e285cb888249e9a1bf594

SHA512
e125a5b9a4a646b9a5557cd0f43b325195351c53e245ae5abaae0688c325d12277e3876eb75ea3c0679116e4e0c8f47dbb238e12015de25eb7eae8b6a0bade78

Download Submit
memory/1068-68-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/1516-0-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1516-9-0x0000000004BB0000-0x0000000004BCE000-memory.dmp

Filesize
120KB

Download
memory/1516-46-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/1516-47-0x0000000004BD0000-0x0000000004BEE000-memory.dmp

Filesize
120KB

Download
memory/1516-60-0x0000000004BD0000-0x0000000004BEE000-memory.dmp

Filesize
120KB

Download
memory/1628-66-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2232-57-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2580-55-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2580-63-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2592-56-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2592-65-0x0000000001E80000-0x0000000001E9E000-memory.dmp

Filesize
120KB

Download
memory/2592-59-0x0000000000820000-0x000000000083E000-memory.dmp

Filesize
120KB

Download
memory/2788-48-0x0000000004910000-0x000000000492E000-memory.dmp

Filesize
120KB

Download
memory/2788-54-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2788-10-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/2888-67-0x00000000047B0000-0x00000000047CE000-memory.dmp

Filesize
120KB

Download
memory/3020-62-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3020-50-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3020-64-0x00000000047C0000-0x00000000047DE000-memory.dmp

Filesize
120KB

Download
memory/3060-61-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download
memory/3060-49-0x0000000000400000-0x000000000041E000-memory.dmp

Filesize
120KB

Download