05a358f1344d1651249b4811963b692edc5db60fdfe1b6d1178a7c2ba2b62978

Analysis

max time kernel
14s
max time network
122s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
21/10/2023, 17:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
Size

1.5MB
MD5

045d39eec9584a990b27d096348f6f57
SHA1

62c1d171834a630f8f737cf6c092488ec66d5d89
SHA256

05a358f1344d1651249b4811963b692edc5db60fdfe1b6d1178a7c2ba2b62978
SHA512

da31ce8b3c4435224b1bcf014ec9ee53f49c4b701bb16b7ad14a517f0374fa8110b53bb612e6648caff8b960104500dbb3bd612451dc2d0ba66783ffdca39ea2
SSDEEP

24576:A8LCe0ehynTDBCNzMgoytu51ZuSvtRXDnULYrnwHmz8PNHITI4R2k0rb1PV4iefX:A20vTDBCNzJu513tRznrwHmz8tIM4rmM

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 50 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/files/0x0007000000015e41-5.dat	upx
behavioral1/memory/2688-13-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2336-61-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2288-62-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2688-63-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3068-65-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3040-66-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3028-67-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2580-68-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2948-70-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2468-72-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2796-73-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1172-71-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2808-74-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2744-75-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2288-76-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2936-78-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/768-79-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2336-80-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1852-81-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/572-82-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/292-84-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/3028-85-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1720-87-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/836-88-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2948-89-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1172-90-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2468-91-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/572-93-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/292-94-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2308-96-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2168-97-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2316-100-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1516-99-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1240-102-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2436-103-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2064-104-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1436-107-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/596-108-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2212-114-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1148-115-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1732-113-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/2536-112-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1496-110-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1684-109-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1876-118-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1776-119-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/596-121-0x0000000000400000-0x000000000041C000-memory.dmp	upx
behavioral1/memory/1928-120-0x0000000000400000-0x000000000041C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\U:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\W:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\Y:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\G:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\K:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\Q:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\N:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\R:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\S:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\V:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\Z:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\E:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\H:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\M:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\X:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\J:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\L:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\O:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\P:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\A:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\B:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File opened (read-only)	\??\I:	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Google\Temp\african porn several models .mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\action kicking voyeur .mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\bukkake big vagina .rar.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files\Windows Journal\Templates\brasilian porn uncut (Anniston).mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\italian cum [free] femdom (Jenna,Samantha).mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\american bukkake hardcore lesbian cock .rar.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\gay horse licking vagina .mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\german sperm public mistress .zip.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\gang bang animal masturbation .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\asian horse lesbian uncut titts .zip.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\british fetish gang bang [free] shower .mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files\DVD Maker\Shared\spanish handjob several models .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\horse uncut redhair .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\horse beastiality [free] bondage .zip.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Program Files\Common Files\Microsoft Shared\gay [milf] high heels .zip.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\indian horse hidden 40+ .mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\british lingerie action [milf] femdom .rar.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE291.tmp\brasilian gay nude girls lady (Janette).rar.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAPE56E.tmp\malaysia hardcore masturbation hairy .mpeg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\mssrv.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP9E41.tmp\japanese action hot (!) stockings .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor\lesbian masturbation (Britney,Tatjana).rar.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.SharePoint.BusinessData.Administration.Client.Intl\fucking lesbian catfight .avi.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\animal big nipples .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.SharePoint.BusinessData.Administration.Client\black gay big black hairunshaved .avi.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor\action horse hot (!) .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.GroupPolicy.AdmTmplEditor.Resources\italian animal licking .mpg.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP6B8E.tmp\italian lingerie kicking [bangbus] .zip.exe	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2948	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2468	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1172	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2796	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2808	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2936	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2744	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
768	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
572	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2948	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
292	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1172	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1720	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
836	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2808	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2168	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2308	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2316	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1240	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1516	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2436	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2468	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2796	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2064	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2064	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1684	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1684	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1148	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1148	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1876	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
1876	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 2688	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	28
PID 2336 wrote to memory of 2688	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	28
PID 2336 wrote to memory of 2688	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	28
PID 2336 wrote to memory of 2688	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	28
PID 2688 wrote to memory of 2580	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	29
PID 2688 wrote to memory of 2580	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	29
PID 2688 wrote to memory of 2580	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	29
PID 2688 wrote to memory of 2580	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	29
PID 2336 wrote to memory of 2288	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	30
PID 2336 wrote to memory of 2288	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	30
PID 2336 wrote to memory of 2288	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	30
PID 2336 wrote to memory of 2288	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	30
PID 2580 wrote to memory of 1852	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	31
PID 2580 wrote to memory of 1852	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	31
PID 2580 wrote to memory of 1852	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	31
PID 2580 wrote to memory of 1852	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	31
PID 2688 wrote to memory of 3040	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	32
PID 2688 wrote to memory of 3040	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	32
PID 2688 wrote to memory of 3040	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	32
PID 2688 wrote to memory of 3040	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	32
PID 2288 wrote to memory of 3068	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	33
PID 2288 wrote to memory of 3068	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	33
PID 2288 wrote to memory of 3068	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	33
PID 2288 wrote to memory of 3068	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	33
PID 2336 wrote to memory of 3028	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	34
PID 2336 wrote to memory of 3028	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	34
PID 2336 wrote to memory of 3028	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	34
PID 2336 wrote to memory of 3028	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	34
PID 1852 wrote to memory of 2948	1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	35
PID 1852 wrote to memory of 2948	1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	35
PID 1852 wrote to memory of 2948	1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	35
PID 1852 wrote to memory of 2948	1852	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	35
PID 3068 wrote to memory of 2468	3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	36
PID 3068 wrote to memory of 2468	3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	36
PID 3068 wrote to memory of 2468	3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	36
PID 3068 wrote to memory of 2468	3068	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	36
PID 3040 wrote to memory of 1172	3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	42
PID 3040 wrote to memory of 1172	3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	42
PID 3040 wrote to memory of 1172	3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	42
PID 3040 wrote to memory of 1172	3040	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	42
PID 2688 wrote to memory of 2796	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	40
PID 2688 wrote to memory of 2796	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	40
PID 2688 wrote to memory of 2796	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	40
PID 2688 wrote to memory of 2796	2688	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	40
PID 2288 wrote to memory of 2808	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	37
PID 2288 wrote to memory of 2808	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	37
PID 2288 wrote to memory of 2808	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	37
PID 2288 wrote to memory of 2808	2288	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	37
PID 2580 wrote to memory of 2744	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	41
PID 2580 wrote to memory of 2744	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	41
PID 2580 wrote to memory of 2744	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	41
PID 2580 wrote to memory of 2744	2580	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	41
PID 2336 wrote to memory of 2936	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	38
PID 2336 wrote to memory of 2936	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	38
PID 2336 wrote to memory of 2936	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	38
PID 2336 wrote to memory of 2936	2336	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	38
PID 3028 wrote to memory of 768	3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	39
PID 3028 wrote to memory of 768	3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	39
PID 3028 wrote to memory of 768	3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	39
PID 3028 wrote to memory of 768	3028	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	39
PID 2948 wrote to memory of 572	2948	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	43
PID 2948 wrote to memory of 572	2948	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	43
PID 2948 wrote to memory of 572	2948	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	43
PID 2948 wrote to memory of 572	2948	NEAS.045d39eec9584a990b27d096348f6f57_JC.exe	43

C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:572
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:596
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        10⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:16128
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:15824
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:1496
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:13608
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:16088
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14488
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15008
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14640
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:16104
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14188
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9984
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13964
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3832
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14856
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:2000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:11516
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:15016
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14308
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:16056
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:14164
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        9⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3848
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13560
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14792
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14204
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:15816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15064
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14784
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3688
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14712
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3856
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16120
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:16152
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:1996
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15256
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:15760
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14896
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:10352
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:13692
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:14284
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        7⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14464
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5572
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14156
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14012
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14616
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:3948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:15516
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:6288
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14124
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:15232
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:14864
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:5180
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14704
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        6⤵
        
        PID:16460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:11556
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:13756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14880
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14552
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:14568
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:16072
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14052
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14332
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:2264
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:11508
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
        5⤵
        
        PID:16468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14664
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:13804
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:15000
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  PID:1968
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:13616
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:2584
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:14960
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  PID:3980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:14324
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
      4⤵
      PID:16000
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:16096
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  PID:6564
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:14092
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  PID:9036
- - C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
    3⤵
    PID:16476
- C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.045d39eec9584a990b27d096348f6f57_JC.exe"
  2⤵
  PID:15776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\horse uncut redhair .mpg.exe

Filesize
494KB

MD5
149e924f8d7f0650d37a0cd75aae7453

SHA1
1eb54b9b287175384e1f821affea8f94c4cfe56c

SHA256
27a39a71bcc13981663f4ebafbadac4211766344a1b94c43cf98172011865a88

SHA512
cba2382f2440818181f55cfdab54e5512cf4769ff889e160ac908b41ca26180a8552d09a5a81b6f3432c5cb9d014660a65889d769c57b61c15f9e3d5077803d7

Download Submit
memory/292-111-0x00000000047C0000-0x00000000047DC000-memory.dmp

Filesize
112KB

Download
memory/292-84-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/292-94-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/572-122-0x00000000044D0000-0x00000000044EC000-memory.dmp

Filesize
112KB

Download
memory/572-82-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/572-93-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/596-108-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/596-121-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/768-79-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/836-88-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1148-115-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1172-90-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1172-71-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1172-86-0x0000000004580000-0x000000000459C000-memory.dmp

Filesize
112KB

Download
memory/1172-95-0x0000000004580000-0x000000000459C000-memory.dmp

Filesize
112KB

Download
memory/1240-102-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1436-107-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1496-110-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1516-99-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1684-109-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1720-87-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1732-113-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1776-119-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1852-81-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1852-83-0x00000000045D0000-0x00000000045EC000-memory.dmp

Filesize
112KB

Download
memory/1876-118-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1928-120-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2064-104-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2168-97-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2212-114-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2288-76-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2288-62-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2308-96-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2316-100-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2336-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2336-12-0x0000000004C60000-0x0000000004C7C000-memory.dmp

Filesize
112KB

Download
memory/2336-61-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2336-80-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2336-69-0x0000000004C60000-0x0000000004C7C000-memory.dmp

Filesize
112KB

Download
memory/2436-103-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2468-91-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2468-72-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2536-112-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2580-92-0x0000000004610000-0x000000000462C000-memory.dmp

Filesize
112KB

Download
memory/2580-68-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2688-64-0x00000000047D0000-0x00000000047EC000-memory.dmp

Filesize
112KB

Download
memory/2688-77-0x00000000047D0000-0x00000000047EC000-memory.dmp

Filesize
112KB

Download
memory/2688-13-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2688-63-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2744-75-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2744-101-0x0000000004580000-0x000000000459C000-memory.dmp

Filesize
112KB

Download
memory/2744-117-0x0000000004580000-0x000000000459C000-memory.dmp

Filesize
112KB

Download
memory/2796-73-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2808-74-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2936-78-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2936-116-0x00000000044A0000-0x00000000044BC000-memory.dmp

Filesize
112KB

Download
memory/2936-98-0x00000000044A0000-0x00000000044BC000-memory.dmp

Filesize
112KB

Download
memory/2948-89-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2948-123-0x0000000004910000-0x000000000492C000-memory.dmp

Filesize
112KB

Download
memory/2948-70-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2948-106-0x0000000004910000-0x000000000492C000-memory.dmp

Filesize
112KB

Download
memory/3028-67-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3028-85-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3040-66-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3068-65-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download