ec972fff37a33a77b12acc445370efa9ddf228712755a3812502b5271eb3a8a1

Analysis

max time kernel
14s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
11/10/2023, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
Size

139KB
MD5

b8d59ebb4b01f4582abe174006cb8fc3
SHA1

f2214c63aaac05e5aee1cf60ea29ffb16070b748
SHA256

ec972fff37a33a77b12acc445370efa9ddf228712755a3812502b5271eb3a8a1
SHA512

d31b6d80197855a2dadcf28a0da223f968edf37d217cfc8ba60b9b92418e7e77ae5ad3973ba850b0dcb45df54b94155d5d2763d3c2ae7fd94905e0f776a34840
SSDEEP

1536:t1RVCaKgzbLc54hukfgvYnouy8vQf24Y5+9DECtjhOHjE+AH1Es3cuZ+OlQJFH8:t/jbLl/gvQoutvH4DVTUHAH1EBuok

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 5 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2964-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/files/0x00080000000231fd-5.dat	upx
behavioral2/memory/3440-10-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2964-52-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1376-55-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2732-56-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4244-115-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3896-116-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2644-117-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3440-118-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/776-119-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4016-120-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1376-121-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3564-122-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3760-123-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2824-124-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2732-125-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2140-126-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3284-127-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2816-128-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3648-129-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4244-130-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3896-131-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1080-132-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2644-133-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/776-135-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2128-136-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4884-134-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3052-137-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2100-138-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3564-140-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3760-141-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3660-142-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4016-139-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4492-144-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4432-145-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1540-143-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2824-146-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1704-147-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1564-148-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\R:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\T:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\W:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\G:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\H:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\I:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\J:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\L:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\Z:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\Q:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\U:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\B:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\E:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\K:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\M:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\O:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\P:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\V:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\X:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\Y:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\A:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File opened (read-only)	\??\S:	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gang bang [bangbus] ash sm .zip.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\horse lesbian [free] mistress .zip.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\sperm hidden ejaculation .avi.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\canadian lesbian licking pregnant .mpg.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Microsoft\Temp\kicking lingerie hidden .rar.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\american lesbian horse masturbation ash .mpeg.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\sperm beast big stockings .rar.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\asian porn hidden (Sylvia).avi.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Microsoft Office\root\Templates\russian porn uncut high heels .mpg.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\american gay blowjob [free] titts (Janette).mpeg.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\russian lingerie big cock bondage (Sylvia,Melissa).mpg.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\danish trambling lingerie uncut boobs upskirt .rar.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\black beastiality nude [bangbus] legs .rar.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\british blowjob lesbian redhair (Karin).rar.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\chinese horse full movie .rar.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Google\Temp\japanese nude licking fishy .avi.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\horse fetish uncut .zip.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2732	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2732	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
4244	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
4244	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3896	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3896	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2644	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
2644	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
776	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
776	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 3440	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	87
PID 2964 wrote to memory of 3440	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	87
PID 2964 wrote to memory of 3440	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	87
PID 2964 wrote to memory of 1376	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	92
PID 2964 wrote to memory of 1376	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	92
PID 2964 wrote to memory of 1376	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	92
PID 3440 wrote to memory of 2732	3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	93
PID 3440 wrote to memory of 2732	3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	93
PID 3440 wrote to memory of 2732	3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	93
PID 2964 wrote to memory of 4244	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	96
PID 2964 wrote to memory of 4244	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	96
PID 2964 wrote to memory of 4244	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	96
PID 1376 wrote to memory of 3896	1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	97
PID 1376 wrote to memory of 3896	1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	97
PID 1376 wrote to memory of 3896	1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	97
PID 3440 wrote to memory of 2644	3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	98
PID 3440 wrote to memory of 2644	3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	98
PID 3440 wrote to memory of 2644	3440	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	98
PID 2732 wrote to memory of 776	2732	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	99
PID 2732 wrote to memory of 776	2732	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	99
PID 2732 wrote to memory of 776	2732	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	99
PID 2964 wrote to memory of 4016	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	101
PID 2964 wrote to memory of 4016	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	101
PID 2964 wrote to memory of 4016	2964	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	101
PID 1376 wrote to memory of 3564	1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	102
PID 1376 wrote to memory of 3564	1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	102
PID 1376 wrote to memory of 3564	1376	NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe	102

C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        8⤵
        
        PID:17152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:1768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:18128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:12308
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16068
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:1540
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:14948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:16340
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:2816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11820
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:4744
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:18536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11512
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:16076
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:1104
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:18512
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:8356
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:11372
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:16100
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1376
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:18480
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        7⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:16356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:17176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:15212
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:16308
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:16380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18528
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11772
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:16324
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6764
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:920
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:3448
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:18504
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:8216
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:9140
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:12300
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:10600
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        6⤵
        
        PID:17976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:17192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:16232
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:12324
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:17376
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:16884
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:18488
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:8704
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:11780
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:16332
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:4016
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:840
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:18152
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:12348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:10060
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:15228
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:18136
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:11340
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:16052
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:1080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
        5⤵
        
        PID:14924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:10156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:8044
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:9116
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:11900
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:17124
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:5172
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:18496
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
      4⤵
      PID:18208
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:11748
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:16300
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:6264
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:9060
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:11876
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:1076
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:7648
- - C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
    3⤵
    PID:10200
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:8956
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:11644
- C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.b8d59ebb4b01f4582abe174006cb8fc3_JC.exe"
  2⤵
  PID:16348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\gang bang [bangbus] ash sm .zip.exe

Filesize
1.2MB

MD5
8e14f6736c927dd4711eb735958bae26

SHA1
904174c377d9dd632719a80117a282edf868d19c

SHA256
701f2ccb83818a075109bbfca8c92186d1556b1b59591d8e1dcaafb76bd71374

SHA512
511374e9971549524a6f47e9ff9bb1c2e3832362ae063307eb7f9d6e0ce870d2cb8e06a11348f9db67c92670a821d8ab833912b245429e0b6774c7797eb76b72

Download Submit
memory/776-119-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/776-135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1080-132-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1376-55-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1376-121-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1540-143-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1564-148-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1704-147-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2100-138-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2128-136-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2140-126-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2644-133-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2644-117-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2732-56-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2732-125-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2816-128-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2824-124-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2824-146-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2964-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2964-52-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3052-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3284-127-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3440-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3440-118-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3564-140-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3564-122-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3648-129-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3660-142-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3760-123-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3760-141-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3896-131-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3896-116-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4016-139-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4016-120-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4244-130-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4244-115-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4432-145-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4492-144-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4884-134-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download