1316759ce48da712812ca87b3ad25e2cb232bcfbe6c16daccb64ade5010a26a7

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13/10/2023, 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
Size

1.9MB
MD5

62c720be7d8f1281d22af2531a51ee56
SHA1

b5320dd74f442125e926a96a735eb3f4b1855872
SHA256

1316759ce48da712812ca87b3ad25e2cb232bcfbe6c16daccb64ade5010a26a7
SHA512

cf3c5bddf4a7b8f040219237347358c62fe1efc942633c7d4c3708a207f90c5a1ba1de8b3b30c7436955bbeb61e2ed76de8b54bc751a61052b06256926eb1589
SSDEEP

49152:Bsj27j2UGnJhZnT1Qr5W2Ad9XxlF0qJTFXo25:Bz7jQnvZT1Qml6qJxXz5

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2112-0-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/files/0x0007000000015c60-5.dat	upx
behavioral1/memory/2304-22-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2112-53-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2304-56-0x00000000047E0000-0x0000000004801000-memory.dmp	upx
behavioral1/memory/2304-57-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2112-58-0x0000000004FF0000-0x0000000005011000-memory.dmp	upx
behavioral1/memory/2304-61-0x00000000047F0000-0x0000000004811000-memory.dmp	upx
behavioral1/memory/2472-64-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1276-62-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-65-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2928-67-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1868-69-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2548-70-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1068-72-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2472-77-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1276-76-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/756-74-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3060-73-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2544-78-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1068-81-0x0000000004920000-0x0000000004941000-memory.dmp	upx
behavioral1/memory/2824-82-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1868-83-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/3060-85-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/756-86-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1628-88-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2824-90-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2136-93-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1592-94-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2876-95-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/2424-92-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1980-91-0x0000000000400000-0x0000000000421000-memory.dmp	upx
behavioral1/memory/1688-89-0x0000000000400000-0x0000000000421000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\B:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\E:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\I:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\L:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\X:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\J:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\K:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\O:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\P:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\Q:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\U:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\H:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\R:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\V:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\Z:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\Y:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\G:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\M:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\N:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\S:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\T:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File opened (read-only)	\??\W:	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\cum full movie boobs ash .avi.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\malaysia animal hidden cock femdom (Melissa,Tatjana).zip.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\russian nude several models boots (Sylvia).mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\fetish big mature .mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\african fetish girls hotel .mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\russian lingerie bukkake lesbian (Sonja).zip.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\french beast hidden .zip.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\gay [bangbus] .rar.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\bukkake blowjob girls .avi.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\beast catfight (Sylvia).rar.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files\DVD Maker\Shared\lesbian lingerie sleeping .avi.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files\Windows Journal\Templates\malaysia fucking [bangbus] 50+ .mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\trambling porn sleeping legs young (Britney,Ashley).avi.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\spanish trambling licking feet .mpg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\canadian nude [bangbus] leather (Gina,Sylvia).zip.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\beastiality catfight sm .zip.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\asian animal sleeping (Ashley).avi.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\british kicking lingerie [bangbus] .rar.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\mssrv.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\asian gay full movie glans .mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\chinese lesbian beastiality [free] vagina .mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\cumshot hot (!) .mpeg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\horse [milf] hole .mpg.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\french action catfight glans boots (Samantha).rar.exe	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 55 IoCs

pid	Process
2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2472	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1868	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
756	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
3060	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2824	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1980	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1884	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
300	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2864	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2472	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1628	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
3060	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1868	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1688	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2424	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
756	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2136	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1592	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2876	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2824	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1196	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1884	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1980	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1224	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1644	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1008	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2392	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2864	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
2864	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2304	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	28
PID 2112 wrote to memory of 2304	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	28
PID 2112 wrote to memory of 2304	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	28
PID 2112 wrote to memory of 2304	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	28
PID 2304 wrote to memory of 2548	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	29
PID 2304 wrote to memory of 2548	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	29
PID 2304 wrote to memory of 2548	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	29
PID 2304 wrote to memory of 2548	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	29
PID 2112 wrote to memory of 1068	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	30
PID 2112 wrote to memory of 1068	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	30
PID 2112 wrote to memory of 1068	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	30
PID 2112 wrote to memory of 1068	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	30
PID 2304 wrote to memory of 1276	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	31
PID 2304 wrote to memory of 1276	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	31
PID 2304 wrote to memory of 1276	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	31
PID 2304 wrote to memory of 1276	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	31
PID 2548 wrote to memory of 2544	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	34
PID 2548 wrote to memory of 2544	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	34
PID 2548 wrote to memory of 2544	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	34
PID 2548 wrote to memory of 2544	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	34
PID 1068 wrote to memory of 2472	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	33
PID 1068 wrote to memory of 2472	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	33
PID 1068 wrote to memory of 2472	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	33
PID 1068 wrote to memory of 2472	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	33
PID 2112 wrote to memory of 2928	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	32
PID 2112 wrote to memory of 2928	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	32
PID 2112 wrote to memory of 2928	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	32
PID 2112 wrote to memory of 2928	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	32
PID 1276 wrote to memory of 1868	1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	35
PID 1276 wrote to memory of 1868	1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	35
PID 1276 wrote to memory of 1868	1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	35
PID 1276 wrote to memory of 1868	1276	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	35
PID 2544 wrote to memory of 3060	2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	36
PID 2544 wrote to memory of 3060	2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	36
PID 2544 wrote to memory of 3060	2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	36
PID 2544 wrote to memory of 3060	2544	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	36
PID 2304 wrote to memory of 756	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	37
PID 2304 wrote to memory of 756	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	37
PID 2304 wrote to memory of 756	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	37
PID 2304 wrote to memory of 756	2304	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	37
PID 2112 wrote to memory of 1980	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	39
PID 2112 wrote to memory of 1980	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	39
PID 2112 wrote to memory of 1980	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	39
PID 2112 wrote to memory of 1980	2112	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	39
PID 1068 wrote to memory of 2824	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	40
PID 1068 wrote to memory of 2824	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	40
PID 1068 wrote to memory of 2824	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	40
PID 1068 wrote to memory of 2824	1068	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	40
PID 2548 wrote to memory of 1884	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	38
PID 2548 wrote to memory of 1884	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	38
PID 2548 wrote to memory of 1884	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	38
PID 2548 wrote to memory of 1884	2548	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	38
PID 2472 wrote to memory of 300	2472	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	41
PID 2472 wrote to memory of 300	2472	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	41
PID 2472 wrote to memory of 300	2472	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	41
PID 2472 wrote to memory of 300	2472	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	41
PID 2928 wrote to memory of 2864	2928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	42
PID 2928 wrote to memory of 2864	2928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	42
PID 2928 wrote to memory of 2864	2928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	42
PID 2928 wrote to memory of 2864	2928	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	42
PID 1868 wrote to memory of 1628	1868	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	44
PID 1868 wrote to memory of 1628	1868	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	44
PID 1868 wrote to memory of 1628	1868	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	44
PID 1868 wrote to memory of 1628	1868	NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe	44

C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2548
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        10⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:996
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:15040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:2752
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11400
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        9⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:12224
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11296
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:10324
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11344
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:10380
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12488
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8720
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8748
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:15496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:13896
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:15704
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:13816
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3180
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4256
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11392
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        8⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:15800
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11496
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:16036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4104
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11288
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11504
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:12120
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11904
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:10620
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        7⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11112
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:15712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:10628
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:13880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11472
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:15032
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:13560
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:12408
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:8796
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:4784
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:9784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        6⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:9828
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:11464
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:13112
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:9020
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
        5⤵
        
        PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:10340
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:9648
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:12528
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:11736
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  PID:2976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:9820
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:8392
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:15720
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  PID:3900
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
      4⤵
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:13568
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  PID:6136
- - C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
    3⤵
    PID:12928
- C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.NEAS62c720be7d8f1281d22af2531a51ee56exe_JC.exe"
  2⤵
  PID:10672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\african fetish girls hotel .mpeg.exe

Filesize
992KB

MD5
58aedaa0a12b92509e9e60ad258bea52

SHA1
66554655e9c1dd3d9c04b11b84df2592cd488109

SHA256
0648c77d66a907911a6c58dd1d796d64b0e048532f39d10679a28193c92467ff

SHA512
20e150ca7d26eac18739ae38286fc9c3156e65677b22947dbc1f2a3db1cd970a9884d4cf8de668f07ab1126d967434b7634e7c862dda742f946a4b7b13d6b956

Download Submit
memory/756-74-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/756-86-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1068-63-0x00000000047D0000-0x00000000047F1000-memory.dmp

Filesize
132KB

Download
memory/1068-72-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1068-81-0x0000000004920000-0x0000000004941000-memory.dmp

Filesize
132KB

Download
memory/1276-76-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1276-62-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1592-94-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1628-88-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1688-89-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1868-69-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1868-83-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/1980-91-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2112-0-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2112-80-0x0000000004FF0000-0x0000000005011000-memory.dmp

Filesize
132KB

Download
memory/2112-66-0x0000000004FF0000-0x0000000005011000-memory.dmp

Filesize
132KB

Download
memory/2112-58-0x0000000004FF0000-0x0000000005011000-memory.dmp

Filesize
132KB

Download
memory/2112-55-0x0000000004FE0000-0x0000000005001000-memory.dmp

Filesize
132KB

Download
memory/2112-53-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2112-21-0x0000000004FE0000-0x0000000005001000-memory.dmp

Filesize
132KB

Download
memory/2136-93-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2304-57-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2304-75-0x00000000047F0000-0x0000000004811000-memory.dmp

Filesize
132KB

Download
memory/2304-68-0x00000000047E0000-0x0000000004801000-memory.dmp

Filesize
132KB

Download
memory/2304-61-0x00000000047F0000-0x0000000004811000-memory.dmp

Filesize
132KB

Download
memory/2304-56-0x00000000047E0000-0x0000000004801000-memory.dmp

Filesize
132KB

Download
memory/2304-22-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2424-92-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2472-77-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2472-84-0x0000000004910000-0x0000000004931000-memory.dmp

Filesize
132KB

Download
memory/2472-64-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-65-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-78-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2544-71-0x0000000004590000-0x00000000045B1000-memory.dmp

Filesize
132KB

Download
memory/2548-79-0x0000000004A80000-0x0000000004AA1000-memory.dmp

Filesize
132KB

Download
memory/2548-70-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2824-82-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2824-90-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2876-95-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/2928-87-0x00000000047D0000-0x00000000047F1000-memory.dmp

Filesize
132KB

Download
memory/2928-67-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3060-85-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download
memory/3060-73-0x0000000000400000-0x0000000000421000-memory.dmp

Filesize
132KB

Download