fe2a2bd1255b0c2ec335f6e92e7c2d86ca7d7785a29fa615ade2c0d244f5c222

Analysis

max time kernel
91s
max time network
152s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
12/11/2023, 13:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.a28928a28701698cf3810dfad41d01f0.exe
Size

1.7MB
MD5

a28928a28701698cf3810dfad41d01f0
SHA1

dd46890e1cfb38125e560614700e15b916b55a31
SHA256

fe2a2bd1255b0c2ec335f6e92e7c2d86ca7d7785a29fa615ade2c0d244f5c222
SHA512

d63cf999172c8abfe6f3cf9e42ac94dbd8d587ff7a54d30a12287234fbc36fff4132c080b485e199fd60561a82d9118f6edcd5cf1086776599c80b0d80d2da73
SSDEEP

49152:blGOUowCvZdIihhoPLMD52gT2WsnXw6+ioRc:oEI4yLMDp5sX2ip

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 46 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2752-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2436-5-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2436-6-0x0000000004900000-0x000000000491F000-memory.dmp	upx
behavioral1/memory/2540-8-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2752-7-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2440-12-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/652-14-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/268-15-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2804-17-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2436-19-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2124-22-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2156-23-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2252-24-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1732-25-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/816-27-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2004-28-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2496-29-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2540-31-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1652-33-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/544-32-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2572-35-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1524-36-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2440-38-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/268-45-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2316-46-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2804-47-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/652-41-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1128-44-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2684-43-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1704-42-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2536-48-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/588-52-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/544-55-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1652-56-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/560-57-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1524-58-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2328-60-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2684-59-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1204-61-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1820-63-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/588-64-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/3048-67-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1060-69-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/1752-70-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2936-68-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral1/memory/2420-71-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.a28928a28701698cf3810dfad41d01f0.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\E:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\G:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\M:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\R:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\S:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\V:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\W:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\B:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\P:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\T:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\Y:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\Z:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\I:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\N:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\O:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\A:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\H:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\J:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\K:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\L:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\Q:	NEAS.a28928a28701698cf3810dfad41d01f0.exe
File opened (read-only)	\??\U:	NEAS.a28928a28701698cf3810dfad41d01f0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\cum horse catfight mature .mpg.exe	NEAS.a28928a28701698cf3810dfad41d01f0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.a28928a28701698cf3810dfad41d01f0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe
652	NEAS.a28928a28701698cf3810dfad41d01f0.exe
268	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2804	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2536	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2004	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2124	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe
1732	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2156	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2252	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe
652	NEAS.a28928a28701698cf3810dfad41d01f0.exe
268	NEAS.a28928a28701698cf3810dfad41d01f0.exe
816	NEAS.a28928a28701698cf3810dfad41d01f0.exe
544	NEAS.a28928a28701698cf3810dfad41d01f0.exe
1652	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2804	NEAS.a28928a28701698cf3810dfad41d01f0.exe
560	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2536	NEAS.a28928a28701698cf3810dfad41d01f0.exe
1524	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe
1704	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2316	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2684	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2004	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe
1128	NEAS.a28928a28701698cf3810dfad41d01f0.exe
2124	NEAS.a28928a28701698cf3810dfad41d01f0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2436	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	30
PID 2752 wrote to memory of 2436	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	30
PID 2752 wrote to memory of 2436	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	30
PID 2752 wrote to memory of 2436	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	30
PID 2436 wrote to memory of 2496	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	31
PID 2436 wrote to memory of 2496	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	31
PID 2436 wrote to memory of 2496	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	31
PID 2436 wrote to memory of 2496	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	31
PID 2752 wrote to memory of 2540	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	32
PID 2752 wrote to memory of 2540	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	32
PID 2752 wrote to memory of 2540	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	32
PID 2752 wrote to memory of 2540	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	32
PID 2436 wrote to memory of 2572	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	33
PID 2436 wrote to memory of 2572	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	33
PID 2436 wrote to memory of 2572	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	33
PID 2436 wrote to memory of 2572	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	33
PID 2496 wrote to memory of 2440	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	34
PID 2496 wrote to memory of 2440	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	34
PID 2496 wrote to memory of 2440	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	34
PID 2496 wrote to memory of 2440	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	34
PID 2436 wrote to memory of 652	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	36
PID 2436 wrote to memory of 652	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	36
PID 2436 wrote to memory of 652	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	36
PID 2436 wrote to memory of 652	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	36
PID 2752 wrote to memory of 268	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	35
PID 2752 wrote to memory of 268	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	35
PID 2752 wrote to memory of 268	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	35
PID 2752 wrote to memory of 268	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	35
PID 2540 wrote to memory of 2804	2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe	37
PID 2540 wrote to memory of 2804	2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe	37
PID 2540 wrote to memory of 2804	2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe	37
PID 2540 wrote to memory of 2804	2540	NEAS.a28928a28701698cf3810dfad41d01f0.exe	37
PID 2572 wrote to memory of 2536	2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe	38
PID 2572 wrote to memory of 2536	2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe	38
PID 2572 wrote to memory of 2536	2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe	38
PID 2572 wrote to memory of 2536	2572	NEAS.a28928a28701698cf3810dfad41d01f0.exe	38
PID 2440 wrote to memory of 2004	2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe	39
PID 2440 wrote to memory of 2004	2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe	39
PID 2440 wrote to memory of 2004	2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe	39
PID 2440 wrote to memory of 2004	2440	NEAS.a28928a28701698cf3810dfad41d01f0.exe	39
PID 2496 wrote to memory of 2124	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	40
PID 2496 wrote to memory of 2124	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	40
PID 2496 wrote to memory of 2124	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	40
PID 2496 wrote to memory of 2124	2496	NEAS.a28928a28701698cf3810dfad41d01f0.exe	40
PID 268 wrote to memory of 1732	268	NEAS.a28928a28701698cf3810dfad41d01f0.exe	43
PID 268 wrote to memory of 1732	268	NEAS.a28928a28701698cf3810dfad41d01f0.exe	43
PID 268 wrote to memory of 1732	268	NEAS.a28928a28701698cf3810dfad41d01f0.exe	43
PID 268 wrote to memory of 1732	268	NEAS.a28928a28701698cf3810dfad41d01f0.exe	43
PID 2436 wrote to memory of 2156	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	44
PID 2436 wrote to memory of 2156	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	44
PID 2436 wrote to memory of 2156	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	44
PID 2436 wrote to memory of 2156	2436	NEAS.a28928a28701698cf3810dfad41d01f0.exe	44
PID 2752 wrote to memory of 2252	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	42
PID 2752 wrote to memory of 2252	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	42
PID 2752 wrote to memory of 2252	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	42
PID 2752 wrote to memory of 2252	2752	NEAS.a28928a28701698cf3810dfad41d01f0.exe	42
PID 652 wrote to memory of 816	652	NEAS.a28928a28701698cf3810dfad41d01f0.exe	41
PID 652 wrote to memory of 816	652	NEAS.a28928a28701698cf3810dfad41d01f0.exe	41
PID 652 wrote to memory of 816	652	NEAS.a28928a28701698cf3810dfad41d01f0.exe	41
PID 652 wrote to memory of 816	652	NEAS.a28928a28701698cf3810dfad41d01f0.exe	41
PID 2804 wrote to memory of 544	2804	NEAS.a28928a28701698cf3810dfad41d01f0.exe	45
PID 2804 wrote to memory of 544	2804	NEAS.a28928a28701698cf3810dfad41d01f0.exe	45
PID 2804 wrote to memory of 544	2804	NEAS.a28928a28701698cf3810dfad41d01f0.exe	45
PID 2804 wrote to memory of 544	2804	NEAS.a28928a28701698cf3810dfad41d01f0.exe	45

C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        9⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        9⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        9⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:14920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3804
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:14888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:12732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:14904
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3568
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:11788
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:16460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:11880
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:2420
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:15136
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:1808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:112
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4572
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:13612
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3844
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12700
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:10448
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12488
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:6776
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:10496
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2540
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:1004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:14944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:1892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:16352
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:13104
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13048
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12708
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:10528
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        7⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:4440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:10560
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:12536
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12416
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4164
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:10464
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:11232
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:9708
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:8228
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:12644
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        6⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13596
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:10608
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:12768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
        5⤵
        
        PID:13748
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:8392
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:8456
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12472
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:8056
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:10972
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  PID:588
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:13580
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:10260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:6556
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:10640
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  PID:2160
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:12464
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:13716
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:10964
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
      4⤵
      PID:13652
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:11032
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
    3⤵
    PID:11864
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  PID:6384
- C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.a28928a28701698cf3810dfad41d01f0.exe"
  2⤵
  PID:10672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-15-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/268-45-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/544-32-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/544-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/560-57-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/588-64-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/588-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/652-53-0x00000000047C0000-0x00000000047DF000-memory.dmp

Filesize
124KB

Download
memory/652-41-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/652-14-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/816-27-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1060-69-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1128-44-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1204-61-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1524-58-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1524-36-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1652-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1652-33-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1704-42-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1732-25-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1752-70-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1820-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2004-28-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2124-22-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2156-23-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2252-24-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2316-46-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2328-60-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2420-71-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2436-20-0x0000000004900000-0x000000000491F000-memory.dmp

Filesize
124KB

Download
memory/2436-9-0x0000000004910000-0x000000000492F000-memory.dmp

Filesize
124KB

Download
memory/2436-34-0x0000000004910000-0x000000000492F000-memory.dmp

Filesize
124KB

Download
memory/2436-5-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2436-40-0x0000000004920000-0x000000000493F000-memory.dmp

Filesize
124KB

Download
memory/2436-54-0x0000000004920000-0x000000000493F000-memory.dmp

Filesize
124KB

Download
memory/2436-30-0x0000000004920000-0x000000000493F000-memory.dmp

Filesize
124KB

Download
memory/2436-6-0x0000000004900000-0x000000000491F000-memory.dmp

Filesize
124KB

Download
memory/2436-19-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2440-12-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2440-38-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2496-21-0x00000000045E0000-0x00000000045FF000-memory.dmp

Filesize
124KB

Download
memory/2496-29-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2496-10-0x00000000020C0000-0x00000000020DF000-memory.dmp

Filesize
124KB

Download
memory/2496-37-0x00000000020C0000-0x00000000020DF000-memory.dmp

Filesize
124KB

Download
memory/2536-48-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2540-8-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2540-16-0x00000000044A0000-0x00000000044BF000-memory.dmp

Filesize
124KB

Download
memory/2540-31-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2572-35-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2572-51-0x00000000007B0000-0x00000000007CF000-memory.dmp

Filesize
124KB

Download
memory/2684-59-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2684-43-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2752-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2752-18-0x0000000000860000-0x000000000087F000-memory.dmp

Filesize
124KB

Download
memory/2752-49-0x0000000004860000-0x000000000487F000-memory.dmp

Filesize
124KB

Download
memory/2752-7-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2752-62-0x0000000004860000-0x000000000487F000-memory.dmp

Filesize
124KB

Download
memory/2752-13-0x0000000004860000-0x000000000487F000-memory.dmp

Filesize
124KB

Download
memory/2752-39-0x0000000004860000-0x000000000487F000-memory.dmp

Filesize
124KB

Download
memory/2752-4-0x0000000000860000-0x000000000087F000-memory.dmp

Filesize
124KB

Download
memory/2804-17-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2804-47-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2936-68-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3048-67-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download