42c3dada3db56a22688a3d6e0c44290f8d3213f2b623293009d59c37de3bf69e

Analysis

max time kernel
151s
max time network
147s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
15/11/2023, 00:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
Size

1.5MB
MD5

1d7b56c942dc26f79b6bfc9365c0ff40
SHA1

7e04f04e2a3dc56a9d93a23ecbe3455fdaa09593
SHA256

42c3dada3db56a22688a3d6e0c44290f8d3213f2b623293009d59c37de3bf69e
SHA512

b12f5a12f0fc987a9b5bf29c0ff77b36cb1f99bf17c67e50a409561864a88f052a145701544db1bca6079ca7eb3cd3980368853dcec9d3b3b8aed22f0be7b4e1
SSDEEP

24576:oWfKIzIE9IL9Mo8q+hvDKEyL7u9oUG+A8FwMnLd7P496mxwhRuP3dNbno+w6qLsG:VfH49TZ+RDkfu9oF+/ZmahREnbfwDWzG

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\T:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\Z:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\B:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\E:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\K:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\P:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\I:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\U:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\V:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\Y:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\A:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\H:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\S:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\N:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\O:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\Q:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\W:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\G:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\J:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\L:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\M:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File opened (read-only)	\??\X:	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\swedish horse horse public bedroom .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\swedish gang bang xxx [milf] beautyfull .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\System32\DriverStore\Temp\hardcore hot (!) glans .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\SysWOW64\FxsTmp\blowjob uncut high heels .avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\SysWOW64\IME\shared\russian horse lesbian lesbian hole .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\japanese nude xxx voyeur lady .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\russian cumshot blowjob sleeping 40+ .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Google\Temp\indian fetish blowjob lesbian granny .mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\xxx girls swallow (Anniston,Tatjana).rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\gay voyeur (Liz).rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\horse masturbation (Samantha).avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files\Common Files\Microsoft Shared\brasilian fetish gay uncut .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\russian nude sperm several models .zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\hardcore catfight .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Google\Update\Download\blowjob [bangbus] hole .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\black action xxx lesbian titts granny .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files\DVD Maker\Shared\russian cum fucking voyeur (Curtney).zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files\Windows Journal\Templates\lingerie several models titts .avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\hardcore sleeping hole .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\danish fetish gay hidden .zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe

Drops file in Windows directory 31 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\brasilian cumshot lesbian masturbation titts sm (Liz).mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\temp\gay [milf] glans .mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\Windows\Templates\fucking lesbian glans wifey .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\Downloaded Program Files\tyrkish fetish sperm sleeping ô (Kathrin,Karin).rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\PLA\Templates\italian nude bukkake [bangbus] .mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\SoftwareDistribution\Download\black horse fucking lesbian hole young .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\brasilian cum trambling uncut stockings .avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\beast hidden boots (Kathrin,Jade).avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\sperm masturbation titts hotel .mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\blowjob full movie cock latex .zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Temp\italian fetish blowjob licking (Sarah).rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\mssrv.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\tmp\lingerie full movie ejaculation .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Temporary ASP.NET Files\gay hot (!) titts .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\LocalService\Downloads\brasilian gang bang lesbian [milf] wifey (Jenna,Tatjana).rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\Temporary Internet Files\russian handjob fucking [milf] .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\russian porn horse several models sweet .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\xxx sleeping hotel .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\security\templates\bukkake lesbian .zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\danish porn blowjob uncut .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Templates\gay sleeping redhair .zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\tyrkish action gay [milf] cock .avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\indian gang bang bukkake licking YEâPSè& .mpeg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\ServiceProfiles\NetworkService\Downloads\brasilian nude trambling voyeur cock .mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Temp\horse [free] titts shoes .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Temporary ASP.NET Files\french beast lesbian titts .mpg.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\xxx masturbation hole .avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\beast big ejaculation .avi.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\indian porn horse uncut glans girly (Sarah).rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\horse public titts mistress .zip.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Temp\bukkake lesbian latex .rar.exe	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2172	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2276	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1996	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1092	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1684	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
620	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2716	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2700	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2864	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2172	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2200	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1580	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
940	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2028	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2276	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
848	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1996	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2952	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2360	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1716	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
1684	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2944	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2944	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
620	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
620	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2716	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2716	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2352	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2352	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2192	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2192	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2296	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
2296	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 2860	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	28
PID 2300 wrote to memory of 2860	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	28
PID 2300 wrote to memory of 2860	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	28
PID 2300 wrote to memory of 2860	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	28
PID 2860 wrote to memory of 3004	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	29
PID 2860 wrote to memory of 3004	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	29
PID 2860 wrote to memory of 3004	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	29
PID 2860 wrote to memory of 3004	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	29
PID 2300 wrote to memory of 3008	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	30
PID 2300 wrote to memory of 3008	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	30
PID 2300 wrote to memory of 3008	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	30
PID 2300 wrote to memory of 3008	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	30
PID 3004 wrote to memory of 800	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	31
PID 3004 wrote to memory of 800	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	31
PID 3004 wrote to memory of 800	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	31
PID 3004 wrote to memory of 800	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	31
PID 3008 wrote to memory of 2868	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	32
PID 3008 wrote to memory of 2868	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	32
PID 3008 wrote to memory of 2868	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	32
PID 3008 wrote to memory of 2868	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	32
PID 2300 wrote to memory of 2412	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	33
PID 2300 wrote to memory of 2412	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	33
PID 2300 wrote to memory of 2412	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	33
PID 2300 wrote to memory of 2412	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	33
PID 2860 wrote to memory of 2172	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	34
PID 2860 wrote to memory of 2172	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	34
PID 2860 wrote to memory of 2172	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	34
PID 2860 wrote to memory of 2172	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	34
PID 800 wrote to memory of 2276	800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	35
PID 800 wrote to memory of 2276	800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	35
PID 800 wrote to memory of 2276	800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	35
PID 800 wrote to memory of 2276	800	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	35
PID 2868 wrote to memory of 1996	2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	36
PID 2868 wrote to memory of 1996	2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	36
PID 2868 wrote to memory of 1996	2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	36
PID 2868 wrote to memory of 1996	2868	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	36
PID 2412 wrote to memory of 1684	2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	38
PID 2412 wrote to memory of 1684	2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	38
PID 2412 wrote to memory of 1684	2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	38
PID 2412 wrote to memory of 1684	2412	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	38
PID 3004 wrote to memory of 1092	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	37
PID 3004 wrote to memory of 1092	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	37
PID 3004 wrote to memory of 1092	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	37
PID 3004 wrote to memory of 1092	3004	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	37
PID 3008 wrote to memory of 620	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	41
PID 3008 wrote to memory of 620	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	41
PID 3008 wrote to memory of 620	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	41
PID 3008 wrote to memory of 620	3008	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	41
PID 2300 wrote to memory of 2700	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	40
PID 2300 wrote to memory of 2700	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	40
PID 2300 wrote to memory of 2700	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	40
PID 2300 wrote to memory of 2700	2300	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	40
PID 2172 wrote to memory of 2716	2172	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	39
PID 2172 wrote to memory of 2716	2172	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	39
PID 2172 wrote to memory of 2716	2172	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	39
PID 2172 wrote to memory of 2716	2172	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	39
PID 2860 wrote to memory of 2864	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	42
PID 2860 wrote to memory of 2864	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	42
PID 2860 wrote to memory of 2864	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	42
PID 2860 wrote to memory of 2864	2860	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	42
PID 2276 wrote to memory of 2200	2276	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	43
PID 2276 wrote to memory of 2200	2276	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	43
PID 2276 wrote to memory of 2200	2276	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	43
PID 2276 wrote to memory of 2200	2276	NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        10⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        10⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:17092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:18436
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:17400
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:17996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:18324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:18348
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:2464
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:19860
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:19288
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:18292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:19872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1092
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:18212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:18908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:18448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:19320
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3692
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:2356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:19484
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:18456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14664
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10860
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2172
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:18012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:20596
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:16556
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:19976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:19880
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:1812
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:19428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:2880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:18332
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14400
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6108
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10412
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:2804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17860
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:15728
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:11036
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:17568
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:8644
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:11132
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:18300
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        9⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:16936
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:17448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:18276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:18316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:2984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        8⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:20604
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:19260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19944
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:19312
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:19968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:18004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:2312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:18284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10276
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:18236
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:620
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17036
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:17580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:3724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19984
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10884
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:19300
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:12004
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10372
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:5096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:19888
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:11980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:11484
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:6924
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        7⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:19992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10908
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:18228
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:16340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:19896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10852
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10984
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7532
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:18260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:16528
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:14784
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:11244
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:692
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:3264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:19460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:112
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:21940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:18160
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:18552
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:6336
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:11548
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:10476
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:3844
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:17444
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:8352
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:6360
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:10460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:18220
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
      4⤵
      PID:18176
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:7592
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:11460
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:17552
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  PID:3976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:6796
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:11156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:368
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  PID:5576
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:11576
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:16252
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  PID:8636
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:14680
- - C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
    3⤵
    PID:13720
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  PID:11272
- C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.1d7b56c942dc26f79b6bfc9365c0ff40.exe"
  2⤵
  PID:16968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\russian nude sperm several models .zip.exe

Filesize
973KB

MD5
73e173ade0c4913c5e75c06bebcbb063

SHA1
fcc6d8ceeb721ecbb7be7ce553ae11b7323854ee

SHA256
9345356c4fe8e4c88d2b7ce345473ce8e390efc49677aff5b3b91bbb611e6565

SHA512
a689be57967b55cfb21bae623a8c6c5727fc4ba6874dcdca90221c6de0d73d073a15781e9d67d1906a1070f9383a1e8fd6d3690049cad5ea0af3c82ebdd90cee

Download Submit