0d0ef361ecfab91d0c2b9ee60d0971d4f755b7bd041f9351d06dd312b6b6761c

Analysis

max time kernel
58s
max time network
132s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
02-11-2023 16:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
Size

399KB
MD5

2beaa9b90baea56ab1a36677099a70c0
SHA1

1223afed4bc1588d1115e4d859eaa796ee76491f
SHA256

0d0ef361ecfab91d0c2b9ee60d0971d4f755b7bd041f9351d06dd312b6b6761c
SHA512

6fb2dfebde43be6f33bd51d0bf3a48fb95c283298d6cfc7c4659bbb2bcc67665c60c7bc19c5940ee59c41c5482ce8d50f527d6e71eec8dc0f118c3fc55806c37
SSDEEP

6144:dXC4vgmhbIxs3NBR6Eg3ZFzd7Y9/fLoJM8EmfaRl2eCRA1NIFHcx4whn5EOzhRLL:dXCNi9BgdzabMA8eCRWQGZ5EONRcc

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\N:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\O:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\T:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\Y:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\Z:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\A:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\L:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\W:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\K:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\G:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\M:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\P:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\R:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\S:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\V:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\X:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\B:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\H:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\J:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\Q:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\U:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File opened (read-only)	\??\E:	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\DVD Maker\Shared\horse catfight .rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\sperm hidden hotel .mpeg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\sperm uncut gorgeoushorny .mpeg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\lingerie [bangbus] sm (Britney,Tatjana).mpeg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\hardcore big shoes .mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Google\Temp\brasilian beastiality horse sleeping feet .zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\russian action xxx hidden titts .mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files\Common Files\Microsoft Shared\tyrkish handjob lingerie lesbian glans mature .zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black fetish horse [free] cock (Gina,Karin).avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Google\Update\Download\japanese animal beast [free] feet (Anniston,Samantha).zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\brasilian gang bang blowjob hidden glans black hairunshaved (Samantha).zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\blowjob public (Sarah).zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files\Windows Journal\Templates\fucking hidden hole leather .avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\danish fetish fucking [bangbus] hole swallow (Curtney).avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\american fetish horse voyeur (Liz).mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe

Drops file in Windows directory 20 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\black fetish xxx lesbian glans fishy .mpeg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\american cumshot sperm uncut glans (Sonja,Karin).mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\black beastiality blowjob [free] glans .mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\swedish gang bang trambling uncut feet blondie (Jade).rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\tyrkish kicking bukkake voyeur lady .zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\horse full movie cock lady (Jade).rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\lingerie hidden (Jade).avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\gay voyeur cock circumcision .rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\danish cum sperm sleeping feet .avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\russian animal fucking hot (!) (Tatjana).mpeg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\black action bukkake [bangbus] .zip.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\tyrkish beastiality fucking catfight glans shower .mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\temp\xxx full movie redhair .rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\Downloaded Program Files\tyrkish gang bang lingerie [milf] (Liz).avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\swedish fetish sperm girls titts .rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\russian action blowjob full movie granny .mpg.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\american animal lingerie sleeping cock hairy .rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\assembly\tmp\bukkake [free] titts .avi.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\lingerie public .rar.exe	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1996	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1244	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1648	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2212	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2452	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2204	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2424	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1232	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1456	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1996	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1756	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1552	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2748	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2880	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2736	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1244	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1648	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2840	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2576	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2576	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1300	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1300	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2920	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2920	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2424	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2424	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2204	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
2204	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1136	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1136	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
1376	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2820	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	29
PID 2948 wrote to memory of 2820	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	29
PID 2948 wrote to memory of 2820	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	29
PID 2948 wrote to memory of 2820	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	29
PID 2820 wrote to memory of 2340	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	30
PID 2820 wrote to memory of 2340	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	30
PID 2820 wrote to memory of 2340	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	30
PID 2820 wrote to memory of 2340	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	30
PID 2948 wrote to memory of 1048	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	31
PID 2948 wrote to memory of 1048	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	31
PID 2948 wrote to memory of 1048	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	31
PID 2948 wrote to memory of 1048	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	31
PID 2820 wrote to memory of 2168	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	32
PID 2820 wrote to memory of 2168	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	32
PID 2820 wrote to memory of 2168	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	32
PID 2820 wrote to memory of 2168	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	32
PID 2340 wrote to memory of 1720	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	33
PID 2340 wrote to memory of 1720	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	33
PID 2340 wrote to memory of 1720	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	33
PID 2340 wrote to memory of 1720	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	33
PID 1048 wrote to memory of 1964	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	34
PID 1048 wrote to memory of 1964	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	34
PID 1048 wrote to memory of 1964	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	34
PID 1048 wrote to memory of 1964	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	34
PID 2948 wrote to memory of 1780	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	35
PID 2948 wrote to memory of 1780	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	35
PID 2948 wrote to memory of 1780	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	35
PID 2948 wrote to memory of 1780	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	35
PID 2168 wrote to memory of 1996	2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	36
PID 2168 wrote to memory of 1996	2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	36
PID 2168 wrote to memory of 1996	2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	36
PID 2168 wrote to memory of 1996	2168	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	36
PID 2820 wrote to memory of 1244	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	37
PID 2820 wrote to memory of 1244	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	37
PID 2820 wrote to memory of 1244	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	37
PID 2820 wrote to memory of 1244	2820	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	37
PID 1964 wrote to memory of 1648	1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	38
PID 1964 wrote to memory of 1648	1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	38
PID 1964 wrote to memory of 1648	1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	38
PID 1964 wrote to memory of 1648	1964	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	38
PID 1720 wrote to memory of 2212	1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	39
PID 1720 wrote to memory of 2212	1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	39
PID 1720 wrote to memory of 2212	1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	39
PID 1720 wrote to memory of 2212	1720	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	39
PID 2340 wrote to memory of 2424	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	40
PID 2340 wrote to memory of 2424	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	40
PID 2340 wrote to memory of 2424	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	40
PID 2340 wrote to memory of 2424	2340	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	40
PID 1780 wrote to memory of 2452	1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	41
PID 1780 wrote to memory of 2452	1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	41
PID 1780 wrote to memory of 2452	1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	41
PID 1780 wrote to memory of 2452	1780	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	41
PID 1048 wrote to memory of 1232	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	43
PID 1048 wrote to memory of 1232	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	43
PID 1048 wrote to memory of 1232	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	43
PID 1048 wrote to memory of 1232	1048	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	43
PID 2948 wrote to memory of 2204	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	42
PID 2948 wrote to memory of 2204	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	42
PID 2948 wrote to memory of 2204	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	42
PID 2948 wrote to memory of 2204	2948	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	42
PID 1996 wrote to memory of 1456	1996	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	44
PID 1996 wrote to memory of 1456	1996	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	44
PID 1996 wrote to memory of 1456	1996	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	44
PID 1996 wrote to memory of 1456	1996	NEAS.2beaa9b90baea56ab1a36677099a70c0.exe	44

C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2820
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2576
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:18072
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17616
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17480
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:18832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:1656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17348
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:14724
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15880
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:18104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17992
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15728
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:18208
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16112
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:18024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15864
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:14584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:16016
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:3796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:18452
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:14600
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:16096
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        9⤵
        
        PID:17760
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:18476
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        8⤵
        
        PID:17792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:18096
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17728
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:14556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17560
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:13432
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15944
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16040
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18468
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:18176
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17920
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:16080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17720
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15968
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:18040
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:14740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:20248
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:16208
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:18136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:17904
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17712
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:18008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15752
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:2672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:17512
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:14672
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:14700
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:8996
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:18112
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        6⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:18460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:18200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15896
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15824
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:17736
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:8932
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:18128
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:15688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17608
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15848
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:15920
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:9756
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:18484
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  PID:2800
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
        5⤵
        
        PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:17552
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:14816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:9484
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:17680
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  PID:3960
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
      4⤵
      PID:17752
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:15800
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  PID:5760
- - C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
    3⤵
    PID:15696
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  PID:8608
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  PID:10736
- C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.2beaa9b90baea56ab1a36677099a70c0.exe"
  2⤵
  PID:18184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\hardcore big shoes .mpg.exe

Filesize
108KB

MD5
9ad8063f2c7e0fd3ed1a2d32d1745dcf

SHA1
56b2ce50bf9df823582129c0d90d91cdf437c91b

SHA256
b66ddaf8339db07785af3d5fcaa9a239489346a52aa27494185c9d5c3f6c5631

SHA512
35d97035d13b2f42022e996bfae4146452ff691beb76fba5df676a297fd5042d030cfd3a539793336c05558728e23f82178a243ba9b22a4da5779a0a7d667072

Download Submit