5fe92cd068eca440ad0cca30065e3f7d30d28754085c112f5512fdcbc254c799

Analysis

max time kernel
42s
max time network
27s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
Size

661KB
MD5

c6a092e99ae36c210d73bf47ebe03fad
SHA1

526678fe1ead1290f7c5b8988acf83e18204637d
SHA256

5fe92cd068eca440ad0cca30065e3f7d30d28754085c112f5512fdcbc254c799
SHA512

866f991b014527f545dd7117d1ca2d91fe1322ad14b27effb41c3b5bc8d38b1d3ad8ecd4754caa2c5d366af1f0aa24998d83aa2e8b6fb0e53345e68a8f6b5740
SSDEEP

12288:bPKL8qquStVwZxdGgWY1X1EC8EA9tco2K/lviNiFZ2MtqgBaHzhqcekJcFs1C:bSLYNwZroY1FECJW7iwF8MPBaHQQJMwC

Score

7^/10

persistence upx

Malware Config

Signatures

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2780-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/files/0x0007000000015c5a-5.dat	upx
behavioral1/memory/2780-8-0x0000000004E60000-0x0000000004E7D000-memory.dmp	upx
behavioral1/memory/2940-9-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2584-23-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2780-24-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2940-29-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/3036-28-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2920-30-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2584-32-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1732-33-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1964-35-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2632-36-0x0000000004470000-0x000000000448D000-memory.dmp	upx
behavioral1/memory/2140-41-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1732-38-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1964-42-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1056-44-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1240-45-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2424-48-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1240-49-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2224-50-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1132-63-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/816-67-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2352-69-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/588-72-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2368-73-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1484-78-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1480-80-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2032-81-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2188-83-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2308-85-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2848-87-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2608-89-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/996-91-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/3024-93-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2928-95-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/308-97-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/1960-99-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral1/memory/2284-101-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\Y:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\Z:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\A:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\I:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\K:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\L:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\R:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\S:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\W:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\H:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\M:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\V:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\X:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\T:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\B:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\E:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\J:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\N:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\O:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\P:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\Q:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File opened (read-only)	\??\U:	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe

Drops file in Program Files directory 15 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\gay big circumcision .avi.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files\Windows Journal\Templates\indian cumshot lingerie big hole redhair .mpg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\xxx [bangbus] cock (Sonja,Melissa).mpg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\DocumentShare\tyrkish action sperm catfight .mpg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\black kicking horse uncut .avi.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\italian kicking hardcore big glans (Gina,Sylvia).mpg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Google\Temp\beast uncut hole lady (Karin).mpeg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Space Templates\indian handjob lingerie lesbian balls .avi.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\lingerie several models sm .rar.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\american action blowjob hidden titts sm .avi.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\japanese fetish gay hot (!) (Liz).rar.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\beast girls .avi.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files\DVD Maker\Shared\japanese animal beast hot (!) glans blondie (Sylvia).mpeg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\swedish cum lesbian big .mpg.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\tyrkish action trambling hot (!) .rar.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1952	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2632	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2660	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2920	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1556	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1732	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1924	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1964	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1720	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1224	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1952	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2632	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1508	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2140	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2544	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2920	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1648	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2660	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1728	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1556	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2964	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
484	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
484	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1056	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1056	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1924	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1924	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2500	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2500	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1732	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1732	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2224	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2224	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1240	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1240	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1964	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1964	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1104	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
1104	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2940	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	29
PID 2780 wrote to memory of 2940	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	29
PID 2780 wrote to memory of 2940	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	29
PID 2780 wrote to memory of 2940	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	29
PID 2780 wrote to memory of 2584	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	30
PID 2780 wrote to memory of 2584	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	30
PID 2780 wrote to memory of 2584	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	30
PID 2780 wrote to memory of 2584	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	30
PID 2940 wrote to memory of 2576	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	31
PID 2940 wrote to memory of 2576	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	31
PID 2940 wrote to memory of 2576	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	31
PID 2940 wrote to memory of 2576	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	31
PID 2576 wrote to memory of 2264	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	33
PID 2576 wrote to memory of 2264	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	33
PID 2576 wrote to memory of 2264	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	33
PID 2576 wrote to memory of 2264	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	33
PID 2584 wrote to memory of 3036	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	32
PID 2584 wrote to memory of 3036	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	32
PID 2584 wrote to memory of 3036	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	32
PID 2584 wrote to memory of 3036	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	32
PID 2940 wrote to memory of 1952	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	35
PID 2940 wrote to memory of 1952	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	35
PID 2940 wrote to memory of 1952	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	35
PID 2940 wrote to memory of 1952	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	35
PID 2780 wrote to memory of 2632	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	34
PID 2780 wrote to memory of 2632	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	34
PID 2780 wrote to memory of 2632	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	34
PID 2780 wrote to memory of 2632	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	34
PID 2264 wrote to memory of 2660	2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	37
PID 2264 wrote to memory of 2660	2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	37
PID 2264 wrote to memory of 2660	2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	37
PID 2264 wrote to memory of 2660	2264	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	37
PID 3036 wrote to memory of 2920	3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	36
PID 3036 wrote to memory of 2920	3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	36
PID 3036 wrote to memory of 2920	3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	36
PID 3036 wrote to memory of 2920	3036	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	36
PID 2576 wrote to memory of 1556	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	38
PID 2576 wrote to memory of 1556	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	38
PID 2576 wrote to memory of 1556	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	38
PID 2576 wrote to memory of 1556	2576	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	38
PID 2584 wrote to memory of 1732	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	39
PID 2584 wrote to memory of 1732	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	39
PID 2584 wrote to memory of 1732	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	39
PID 2584 wrote to memory of 1732	2584	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	39
PID 2940 wrote to memory of 1924	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	40
PID 2940 wrote to memory of 1924	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	40
PID 2940 wrote to memory of 1924	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	40
PID 2940 wrote to memory of 1924	2940	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	40
PID 2780 wrote to memory of 1964	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	41
PID 2780 wrote to memory of 1964	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	41
PID 2780 wrote to memory of 1964	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	41
PID 2780 wrote to memory of 1964	2780	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	41
PID 1952 wrote to memory of 1720	1952	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	42
PID 1952 wrote to memory of 1720	1952	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	42
PID 1952 wrote to memory of 1720	1952	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	42
PID 1952 wrote to memory of 1720	1952	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	42
PID 2632 wrote to memory of 1224	2632	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	43
PID 2632 wrote to memory of 1224	2632	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	43
PID 2632 wrote to memory of 1224	2632	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	43
PID 2632 wrote to memory of 1224	2632	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	43
PID 2920 wrote to memory of 1508	2920	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	44
PID 2920 wrote to memory of 1508	2920	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	44
PID 2920 wrote to memory of 1508	2920	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	44
PID 2920 wrote to memory of 1508	2920	NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe	44

C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2660
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:17640
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16628
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:11520
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        9⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11808
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:17680
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16660
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15068
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:12940
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2964
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14572
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16508
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16256
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2928
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14700
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:308
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15752
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:10572
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4228
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:1480
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15256
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15664
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16404
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14152
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:996
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:13952
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15048
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16608
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:3372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:13816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:12468
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14844
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:10156
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:1804
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3036
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:908
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:948
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16132
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16568
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15216
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16336
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:484
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15128
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15784
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4144
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16368
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16764
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:2608
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14080
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:7132
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16668
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:16148
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2632
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:1796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15000
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16772
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16740
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14564
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14260
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:17940
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14708
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:7292
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:10068
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:16232
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15312
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16388
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:936
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        6⤵
        
        PID:11480
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:17688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14668
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:11472
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:7100
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:9736
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:16328
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:2276
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:15304
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16280
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:16376
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  PID:3024
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
        5⤵
        
        PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:16724
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:6564
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:14860
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  PID:3396
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:14716
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
      4⤵
      PID:11696
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:17020
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  PID:4692
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:8308
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:15160
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  PID:5876
- - C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
    3⤵
    PID:16584
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  PID:10140
- C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.c6a092e99ae36c210d73bf47ebe03fad_JC.exe"
  2⤵
  PID:17532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Windows Sidebar\Shared Gadgets\black kicking horse uncut .avi.exe

Filesize
1.8MB

MD5
b1b2ea5e0c5c58be2e3048be66621225

SHA1
029f2ef2a30387cac993ee02feb60fc883fcf8d7

SHA256
dc692b2320431cc9b7d9000f10abd9b1f4650401566a87dcf20bacab16f2247a

SHA512
8415d45c351cd697a0cf3290e9dc6d48d830352d9de837a6bfd74697def4532a2d200f92a1a7d0dad559f4c5aeef7192c3d510687d19c47bbc861db982cba05d

Download Submit
memory/308-97-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/484-79-0x00000000047B0000-0x00000000047CD000-memory.dmp

Filesize
116KB

Download
memory/588-72-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/816-67-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/996-91-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1056-84-0x00000000047B0000-0x00000000047CD000-memory.dmp

Filesize
116KB

Download
memory/1056-44-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1132-63-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1224-100-0x0000000004590000-0x00000000045AD000-memory.dmp

Filesize
116KB

Download
memory/1240-49-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1240-45-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1480-80-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1484-78-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1556-68-0x0000000004710000-0x000000000472D000-memory.dmp

Filesize
116KB

Download
memory/1720-94-0x0000000004910000-0x000000000492D000-memory.dmp

Filesize
116KB

Download
memory/1732-33-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1732-82-0x0000000004950000-0x000000000496D000-memory.dmp

Filesize
116KB

Download
memory/1732-38-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1924-75-0x00000000046D0000-0x00000000046ED000-memory.dmp

Filesize
116KB

Download
memory/1952-47-0x0000000004A50000-0x0000000004A6D000-memory.dmp

Filesize
116KB

Download
memory/1952-96-0x0000000004A50000-0x0000000004A6D000-memory.dmp

Filesize
116KB

Download
memory/1960-99-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1964-42-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1964-35-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1964-86-0x0000000004910000-0x000000000492D000-memory.dmp

Filesize
116KB

Download
memory/2032-81-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2140-41-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2188-83-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2224-50-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2264-39-0x0000000004A50000-0x0000000004A6D000-memory.dmp

Filesize
116KB

Download
memory/2264-64-0x0000000004A50000-0x0000000004A6D000-memory.dmp

Filesize
116KB

Download
memory/2284-101-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2308-85-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2352-69-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2368-73-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2424-48-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2576-77-0x0000000004A70000-0x0000000004A8D000-memory.dmp

Filesize
116KB

Download
memory/2576-26-0x0000000004590000-0x00000000045AD000-memory.dmp

Filesize
116KB

Download
memory/2584-32-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2584-23-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2584-88-0x0000000004920000-0x000000000493D000-memory.dmp

Filesize
116KB

Download
memory/2608-89-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2632-36-0x0000000004470000-0x000000000448D000-memory.dmp

Filesize
116KB

Download
memory/2632-98-0x0000000004920000-0x000000000493D000-memory.dmp

Filesize
116KB

Download
memory/2660-40-0x0000000004580000-0x000000000459D000-memory.dmp

Filesize
116KB

Download
memory/2660-43-0x0000000004580000-0x000000000459D000-memory.dmp

Filesize
116KB

Download
memory/2660-65-0x00000000045D0000-0x00000000045ED000-memory.dmp

Filesize
116KB

Download
memory/2780-92-0x00000000051F0000-0x000000000520D000-memory.dmp

Filesize
116KB

Download
memory/2780-24-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2780-8-0x0000000004E60000-0x0000000004E7D000-memory.dmp

Filesize
116KB

Download
memory/2780-27-0x0000000004E60000-0x0000000004E7D000-memory.dmp

Filesize
116KB

Download
memory/2780-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2848-87-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2920-51-0x0000000004910000-0x000000000492D000-memory.dmp

Filesize
116KB

Download
memory/2920-30-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2928-95-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2940-29-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2940-9-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2940-31-0x0000000004900000-0x000000000491D000-memory.dmp

Filesize
116KB

Download
memory/2940-22-0x0000000004900000-0x000000000491D000-memory.dmp

Filesize
116KB

Download
memory/2940-90-0x0000000004A20000-0x0000000004A3D000-memory.dmp

Filesize
116KB

Download
memory/3024-93-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3036-71-0x0000000004910000-0x000000000492D000-memory.dmp

Filesize
116KB

Download
memory/3036-28-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download