1bf1c0deca0ce78b46aa6708e2f921af6b04dd044252cf274f6b494ec3c6e387

Analysis

max time kernel
29s
max time network
129s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
02/11/2023, 16:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
Size

573KB
MD5

14b15ffc262beb3bef4ee7baf88ba270
SHA1

bf32eb87bc4fbd19de41dd6cb6268b24c3ac4ef6
SHA256

1bf1c0deca0ce78b46aa6708e2f921af6b04dd044252cf274f6b494ec3c6e387
SHA512

b5400b9e07c606496628b7efe85478b0ab5d34d07dd875be2070d94025dfc70ecad0ab6c0bb9ceb92af0bbc366499fd80234733c46fb3ecb42dd568402e8d963
SSDEEP

12288:dXCNi9BA5O+xdE0SNxv0Y2a2v36l4UflbbMTpoigJzQnzgcz+gy:oWAJrjmTIP6BMyiO8z/+R

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\P:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\W:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\A:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\H:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\J:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\B:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\Z:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\R:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\U:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\V:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\E:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\I:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\N:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\O:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\Q:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\S:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\T:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\X:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\G:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\L:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\M:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File opened (read-only)	\??\Y:	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\bukkake kicking uncut Ôë .rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\malaysia lesbian horse hot (!) blondie .rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\System32\DriverStore\Temp\african hardcore big .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\SysWOW64\FxsTmp\gang bang licking ash (Sonja,Sylvia).mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\SysWOW64\IME\shared\handjob nude masturbation .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\System32\LogFiles\Fax\Incoming\tyrkish horse kicking [milf] ash shower .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\SysWOW64\config\systemprofile\fetish full movie .rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\brasilian gang bang big wifey .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\kicking beastiality sleeping cock young .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\fetish hot (!) black hairunshaved (Curtney).zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\gang bang catfight (Curtney,Kathrin).mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files\Common Files\Microsoft Shared\russian beast sperm hot (!) legs 40+ (Liz,Tatjana).avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Google\Temp\action lesbian ash (Kathrin).mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Google\Update\Download\danish blowjob several models (Sandy).avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\canadian horse several models hairy .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\canadian hardcore sleeping sm .avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\gang bang hidden YEâPSè& (Liz).zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files\DVD Maker\Shared\african fucking [bangbus] (Tatjana,Sonja).mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files\Windows Journal\Templates\porn xxx uncut nipples upskirt (Sarah,Melissa).mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\swedish cum sleeping glans beautyfull .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\action public sm .avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\nude masturbation blondie .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\norwegian gang bang masturbation glans boots (Sonja,Britney).mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\french action action lesbian .avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\french sperm licking cock shoes .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\italian sperm fucking sleeping boobs .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\cumshot sleeping sweet (Christine,Samantha).rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\nude licking ejaculation (Kathrin).mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\xxx catfight feet .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\temp\african hardcore [milf] glans upskirt (Sandy).avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\Downloaded Program Files\russian xxx blowjob [bangbus] vagina sweet (Liz,Kathrin).rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\canadian blowjob lesbian fishy .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\blowjob gang bang lesbian shoes .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\japanese animal gang bang big .avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\horse uncut (Britney,Anniston).avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\security\templates\cum bukkake catfight redhair (Sonja).avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\xxx hidden wifey .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\SoftwareDistribution\Download\russian lingerie hardcore uncut nipples granny .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\xxx beastiality masturbation YEâPSè& .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\PLA\Templates\trambling [free] .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\bukkake catfight (Gina,Janette).zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\fucking lesbian beautyfull (Gina).mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\canadian fetish [milf] cock .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\xxx [bangbus] ¼ç .avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\lingerie handjob girls .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\asian trambling big .rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\american bukkake girls vagina .mpg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\german hardcore big Ôë .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\horse hot (!) .zip.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\tmp\african lesbian girls lady .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\french fetish handjob sleeping (Jenna).rar.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\porn sleeping nipples 40+ (Ashley,Sylvia).avi.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\mssrv.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\animal action lesbian .mpeg.exe	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2108	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
344	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1612	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
844	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1692	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2136	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
320	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
884	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2856	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1804	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1616	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1500	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2436	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2044	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2980	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
3064	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2348	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2400	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2068	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1856	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1008	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1272	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
832	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
1548	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2620	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	28
PID 2408 wrote to memory of 2620	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	28
PID 2408 wrote to memory of 2620	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	28
PID 2408 wrote to memory of 2620	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	28
PID 2620 wrote to memory of 2700	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	29
PID 2620 wrote to memory of 2700	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	29
PID 2620 wrote to memory of 2700	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	29
PID 2620 wrote to memory of 2700	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	29
PID 2408 wrote to memory of 1860	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	30
PID 2408 wrote to memory of 1860	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	30
PID 2408 wrote to memory of 1860	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	30
PID 2408 wrote to memory of 1860	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	30
PID 2700 wrote to memory of 3056	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	31
PID 2700 wrote to memory of 3056	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	31
PID 2700 wrote to memory of 3056	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	31
PID 2700 wrote to memory of 3056	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	31
PID 2620 wrote to memory of 2392	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	32
PID 2620 wrote to memory of 2392	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	32
PID 2620 wrote to memory of 2392	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	32
PID 2620 wrote to memory of 2392	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	32
PID 1860 wrote to memory of 1868	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	33
PID 1860 wrote to memory of 1868	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	33
PID 1860 wrote to memory of 1868	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	33
PID 1860 wrote to memory of 1868	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	33
PID 2408 wrote to memory of 2900	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	34
PID 2408 wrote to memory of 2900	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	34
PID 2408 wrote to memory of 2900	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	34
PID 2408 wrote to memory of 2900	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	34
PID 3056 wrote to memory of 2108	3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	35
PID 3056 wrote to memory of 2108	3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	35
PID 3056 wrote to memory of 2108	3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	35
PID 3056 wrote to memory of 2108	3056	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	35
PID 2700 wrote to memory of 1612	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	36
PID 2700 wrote to memory of 1612	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	36
PID 2700 wrote to memory of 1612	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	36
PID 2700 wrote to memory of 1612	2700	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	36
PID 2392 wrote to memory of 344	2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	37
PID 2392 wrote to memory of 344	2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	37
PID 2392 wrote to memory of 344	2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	37
PID 2392 wrote to memory of 344	2392	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	37
PID 2620 wrote to memory of 844	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	38
PID 2620 wrote to memory of 844	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	38
PID 2620 wrote to memory of 844	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	38
PID 2620 wrote to memory of 844	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	38
PID 1860 wrote to memory of 2136	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	39
PID 1860 wrote to memory of 2136	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	39
PID 1860 wrote to memory of 2136	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	39
PID 1860 wrote to memory of 2136	1860	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	39
PID 2900 wrote to memory of 1692	2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	41
PID 2900 wrote to memory of 1692	2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	41
PID 2900 wrote to memory of 1692	2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	41
PID 2900 wrote to memory of 1692	2900	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	41
PID 1868 wrote to memory of 320	1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	40
PID 1868 wrote to memory of 320	1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	40
PID 1868 wrote to memory of 320	1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	40
PID 1868 wrote to memory of 320	1868	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	40
PID 2408 wrote to memory of 884	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	42
PID 2408 wrote to memory of 884	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	42
PID 2408 wrote to memory of 884	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	42
PID 2408 wrote to memory of 884	2408	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	42
PID 2620 wrote to memory of 2856	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	46
PID 2620 wrote to memory of 2856	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	46
PID 2620 wrote to memory of 2856	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	46
PID 2620 wrote to memory of 2856	2620	NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe	46

C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2620
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:17108
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:18888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16300
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2068
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18864
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16852
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16924
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:2668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18048
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:19048
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:1816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3896
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11872
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:13656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18180
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:16244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:21900
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16124
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16996
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:844
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12992
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17092
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:14148
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11848
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12344
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12432
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13360
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11832
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11880
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12496
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11792
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16908
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:18948
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:12312
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16956
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:320
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:18064
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17124
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:1020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:1740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12968
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:17888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10708
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12504
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16076
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12392
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1500
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:13436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17332
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12480
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12472
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:18080
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:13008
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:18000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12284
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12384
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:18228
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12712
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17300
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11824
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11808
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:18220
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:12304
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16876
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16348
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12536
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12352
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17116
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:1736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17068
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16900
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16172
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16988
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3196
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17276
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:2804
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12872
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:9092
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:11968
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16964
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:13708
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16068
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:11704
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16868
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11400
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12836
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:12260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16844
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:832
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16164
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:13048
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:15948
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:15252
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16364
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:2992
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17100
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:11696
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:17228
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17212
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:17044
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:15240
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:11992
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:17284
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:2736
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:7804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:17960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:13080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:15940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:15172
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16340
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:1712
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        6⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
        5⤵
        
        PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:12528
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:13460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:18268
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:12000
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:17268
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:3260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:11800
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
      4⤵
      PID:18196
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:11324
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:16884
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:4596
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:9144
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:12756
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:17324
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:7036
- - C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
    3⤵
    PID:17976
- C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.14b15ffc262beb3bef4ee7baf88ba270.exe"
  2⤵
  PID:13016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\kicking beastiality sleeping cock young .mpg.exe

Filesize
173KB

MD5
20a62e374f88fa9640145d8429f2f994

SHA1
71f9a73206ca91db7a5399127cbe572ea52c11f8

SHA256
23536ab790405ab9d5cb952dff7ee58e39fa5150527a988606b99f5c5f4986da

SHA512
1e1185ce9220571e5d6d32d0cd774d5008ca39766bd37ec66b98beb2359edce35d7e9dc89a45cd7f00c15a4ca3c93ba17af8965f91fa63c0818f353c935d8aa3

Download Submit