5c0b043ba5d2a716910669d8afd3aa16ae28769ffb8f80025c3274f51473f644

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
07/11/2023, 13:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
Size

766KB
MD5

5809d3c96db85798b7d3d5024b2758e1
SHA1

0ed5cbbfef3c3d2510c4b3fbaa37e14a678ca721
SHA256

5c0b043ba5d2a716910669d8afd3aa16ae28769ffb8f80025c3274f51473f644
SHA512

5c84e6b1964b9d7a7fda41034772c48557340a880b37402492330ace7d9fcebdb8e9c50d11bb1c11c53603c7c172f2fa459f31e1c4e807bd1420292bc2ddf7d3
SSDEEP

12288:YEQoSpqh17Lqd0Hnzw9egihrFggt57GWtkncfbk3A4wioOgS6G13nIoUHOsExOjg:YilK2n89/8rFggt8Wacg3NvoC4oUN0HJ

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 43 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2160-0-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/files/0x0009000000015de1-5.dat	upx
behavioral1/memory/3048-11-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3048-49-0x0000000004A40000-0x0000000004A60000-memory.dmp	upx
behavioral1/memory/2844-51-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2584-52-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2160-65-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3040-70-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2864-71-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3056-72-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/680-74-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1112-83-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2548-81-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/3048-80-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2160-79-0x0000000004FB0000-0x0000000004FD0000-memory.dmp	upx
behavioral1/memory/2844-86-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1272-87-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1940-89-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/680-94-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2864-93-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2156-96-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2788-98-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2548-97-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1112-102-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2620-103-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1272-117-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2336-118-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1940-120-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1984-119-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2468-121-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2960-122-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1112-123-0x00000000047D0000-0x00000000047F0000-memory.dmp	upx
behavioral1/memory/2156-124-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2272-126-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2496-127-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2288-128-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2620-131-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/1444-132-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2336-133-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2468-134-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2960-135-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2344-137-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral1/memory/2288-140-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\I:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\N:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\O:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\Q:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\A:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\H:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\J:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\R:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\T:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\V:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\W:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\Y:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\E:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\L:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\M:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\P:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\U:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\X:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\Z:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\B:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\S:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File opened (read-only)	\??\K:	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\gay [bangbus] balls (Sonja,Sylvia).rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\italian action fucking masturbation .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\brasilian porn lesbian [bangbus] (Karin).rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Google\Update\Download\tyrkish beastiality fucking [bangbus] hole .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\beast hot (!) feet 50+ .avi.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\xxx lesbian .avi.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\black porn gay hot (!) (Janette).zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Google\Temp\japanese kicking horse catfight (Samantha).avi.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\brasilian gang bang fucking full movie titts .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\american handjob blowjob uncut mistress .avi.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\lingerie big (Melissa).mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\sperm voyeur 50+ (Christine,Sarah).mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\indian nude sperm full movie titts castration .rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files\DVD Maker\Shared\gay masturbation balls .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Program Files\Windows Journal\Templates\american gang bang gay [milf] (Curtney).zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe

Drops file in Windows directory 30 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian handjob fucking catfight ejaculation .mpeg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\sperm licking penetration .mpeg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\beast [free] 50+ .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\italian porn gay sleeping feet granny .mpeg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\tmp\swedish cum gay big hotel .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\blowjob several models girly (Christine,Karin).zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\danish nude trambling [free] titts redhair .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\brasilian kicking beast [milf] granny .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\hardcore big cock castration .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\bukkake several models hole 50+ .mpeg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\lingerie [milf] (Melissa).mpeg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\trambling sleeping cock (Sonja,Curtney).mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\fucking full movie hole shower .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\american porn trambling uncut feet .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\black beastiality bukkake voyeur feet .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\fucking voyeur glans .mpeg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian beastiality gay [milf] penetration (Ashley,Sylvia).mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\mssrv.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\temp\japanese handjob bukkake sleeping swallow .rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\brasilian kicking trambling voyeur glans .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\horse masturbation (Samantha).avi.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\PLA\Templates\bukkake masturbation ìï .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\security\templates\black fetish xxx hidden .rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\japanese fetish horse girls sweet .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\hardcore [bangbus] balls (Kathrin,Melissa).avi.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\bukkake girls traffic .rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\italian porn sperm uncut cock femdom .mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\Downloaded Program Files\gay full movie glans .rar.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\indian kicking beast full movie circumcision .zip.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\gay masturbation titts swallow (Sylvia).mpg.exe	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3056	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2864	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
680	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2548	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2788	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
1112	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
1272	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
1940	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2156	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
2496	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 3048	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	28
PID 2160 wrote to memory of 3048	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	28
PID 2160 wrote to memory of 3048	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	28
PID 2160 wrote to memory of 3048	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	28
PID 3048 wrote to memory of 2584	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	29
PID 3048 wrote to memory of 2584	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	29
PID 3048 wrote to memory of 2584	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	29
PID 3048 wrote to memory of 2584	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	29
PID 2160 wrote to memory of 2844	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	30
PID 2160 wrote to memory of 2844	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	30
PID 2160 wrote to memory of 2844	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	30
PID 2160 wrote to memory of 2844	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	30
PID 2160 wrote to memory of 2864	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	32
PID 2160 wrote to memory of 2864	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	32
PID 2160 wrote to memory of 2864	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	32
PID 2160 wrote to memory of 2864	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	32
PID 2584 wrote to memory of 3056	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	33
PID 2584 wrote to memory of 3056	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	33
PID 2584 wrote to memory of 3056	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	33
PID 2584 wrote to memory of 3056	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	33
PID 3048 wrote to memory of 3040	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	31
PID 3048 wrote to memory of 3040	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	31
PID 3048 wrote to memory of 3040	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	31
PID 3048 wrote to memory of 3040	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	31
PID 2844 wrote to memory of 680	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	34
PID 2844 wrote to memory of 680	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	34
PID 2844 wrote to memory of 680	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	34
PID 2844 wrote to memory of 680	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	34
PID 2160 wrote to memory of 2548	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	35
PID 2160 wrote to memory of 2548	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	35
PID 2160 wrote to memory of 2548	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	35
PID 2160 wrote to memory of 2548	2160	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	35
PID 3040 wrote to memory of 2788	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	37
PID 3040 wrote to memory of 2788	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	37
PID 3040 wrote to memory of 2788	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	37
PID 3040 wrote to memory of 2788	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	37
PID 3048 wrote to memory of 1112	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	36
PID 3048 wrote to memory of 1112	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	36
PID 3048 wrote to memory of 1112	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	36
PID 3048 wrote to memory of 1112	3048	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	36
PID 2584 wrote to memory of 1272	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	38
PID 2584 wrote to memory of 1272	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	38
PID 2584 wrote to memory of 1272	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	38
PID 2584 wrote to memory of 1272	2584	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	38
PID 2844 wrote to memory of 1940	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	39
PID 2844 wrote to memory of 1940	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	39
PID 2844 wrote to memory of 1940	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	39
PID 2844 wrote to memory of 1940	2844	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	39
PID 3056 wrote to memory of 2156	3056	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	40
PID 3056 wrote to memory of 2156	3056	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	40
PID 3056 wrote to memory of 2156	3056	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	40
PID 3056 wrote to memory of 2156	3056	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	40
PID 2864 wrote to memory of 2496	2864	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	41
PID 2864 wrote to memory of 2496	2864	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	41
PID 2864 wrote to memory of 2496	2864	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	41
PID 2864 wrote to memory of 2496	2864	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	41
PID 680 wrote to memory of 2620	680	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	42
PID 680 wrote to memory of 2620	680	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	42
PID 680 wrote to memory of 2620	680	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	42
PID 680 wrote to memory of 2620	680	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	42
PID 3040 wrote to memory of 1984	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	43
PID 3040 wrote to memory of 1984	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	43
PID 3040 wrote to memory of 1984	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	43
PID 3040 wrote to memory of 1984	3040	NEAS.5809d3c96db85798b7d3d5024b2758e1.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        9⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14252
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:15276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:13604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:14924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:13500
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:13796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:9364
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        8⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:8992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:13516
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1112
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:14988
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:8888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:9080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:2860
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:6752
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:6984
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:8976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:9000
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:14852
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7516
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        7⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:1128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:9276
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:7732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:15232
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:772
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:10484
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:8952
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:7724
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:13508
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:15284
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:15112
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:8608
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7808
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:13992
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:7460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:15200
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        6⤵
        
        PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:8740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:9268
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:15024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7716
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:9100
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:15156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:13816
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:3636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7484
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3108
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:5988
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:13628
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:7692
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:15192
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:7636
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
      4⤵
      PID:11752
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  PID:3240
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:7508
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:15096
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  PID:4060
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
    3⤵
    PID:8896
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  PID:5048
- C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5809d3c96db85798b7d3d5024b2758e1.exe"
  2⤵
  PID:8732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\sperm voyeur 50+ (Christine,Sarah).mpg.exe

Filesize
488KB

MD5
87b55647ef8e7386836f4847aa99e868

SHA1
5e19cdfb2a634b72f0dff2a2c6065ca31c460502

SHA256
28ff686cce13aadf7064f21e27b5af790fe0ce77fb2d365db1bc9b268ef27b67

SHA512
f740b58a266a821ed18e825a828856af76c9baee1f69b079d3b93a0095ee193400b90f6b280a1c1d2c6b72420ef2f38563426150b9185b679af4cfc65de34d44

Download Submit
memory/680-101-0x0000000001DC0000-0x0000000001DE0000-memory.dmp

Filesize
128KB

Download
memory/680-129-0x0000000001DC0000-0x0000000001DE0000-memory.dmp

Filesize
128KB

Download
memory/680-94-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/680-74-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1112-83-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1112-102-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1112-123-0x00000000047D0000-0x00000000047F0000-memory.dmp

Filesize
128KB

Download
memory/1272-142-0x0000000004900000-0x0000000004920000-memory.dmp

Filesize
128KB

Download
memory/1272-87-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1272-117-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1272-130-0x0000000004900000-0x0000000004920000-memory.dmp

Filesize
128KB

Download
memory/1444-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1940-89-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1940-120-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/1984-119-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2156-96-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2156-124-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2160-68-0x00000000052B0000-0x00000000052D0000-memory.dmp

Filesize
128KB

Download
memory/2160-10-0x0000000004FB0000-0x0000000004FD0000-memory.dmp

Filesize
128KB

Download
memory/2160-79-0x0000000004FB0000-0x0000000004FD0000-memory.dmp

Filesize
128KB

Download
memory/2160-0-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2160-91-0x00000000052B0000-0x00000000052D0000-memory.dmp

Filesize
128KB

Download
memory/2160-85-0x00000000052B0000-0x00000000052D0000-memory.dmp

Filesize
128KB

Download
memory/2160-65-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2160-50-0x00000000052B0000-0x00000000052D0000-memory.dmp

Filesize
128KB

Download
memory/2272-126-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2288-128-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2288-140-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2336-118-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2336-133-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2344-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2468-134-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2468-121-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2496-127-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-97-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2548-81-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-90-0x00000000047B0000-0x00000000047D0000-memory.dmp

Filesize
128KB

Download
memory/2584-67-0x00000000047B0000-0x00000000047D0000-memory.dmp

Filesize
128KB

Download
memory/2584-52-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2584-108-0x0000000004910000-0x0000000004930000-memory.dmp

Filesize
128KB

Download
memory/2620-131-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2620-103-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2788-98-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2844-73-0x0000000001D70000-0x0000000001D90000-memory.dmp

Filesize
128KB

Download
memory/2844-51-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2844-88-0x0000000001E30000-0x0000000001E50000-memory.dmp

Filesize
128KB

Download
memory/2844-86-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2864-95-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/2864-93-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2864-71-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-122-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2960-135-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3040-82-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/3040-99-0x00000000047C0000-0x00000000047E0000-memory.dmp

Filesize
128KB

Download
memory/3040-70-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-80-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3048-100-0x0000000004A50000-0x0000000004A70000-memory.dmp

Filesize
128KB

Download
memory/3048-84-0x0000000004A40000-0x0000000004A60000-memory.dmp

Filesize
128KB

Download
memory/3048-69-0x0000000004A50000-0x0000000004A70000-memory.dmp

Filesize
128KB

Download
memory/3048-125-0x0000000004A60000-0x0000000004A80000-memory.dmp

Filesize
128KB

Download
memory/3048-92-0x0000000004A50000-0x0000000004A70000-memory.dmp

Filesize
128KB

Download
memory/3048-49-0x0000000004A40000-0x0000000004A60000-memory.dmp

Filesize
128KB

Download
memory/3048-11-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3056-72-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download