c222170b04d6a3c56cd095bb5990880ed28fd343ef6f341442a670230b4af081

Analysis

max time kernel
8s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
01/11/2023, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
Size

1.5MB
MD5

6d61a51a0012377e9fa37ea87f4bcc90
SHA1

c1a6df309b3a228d14a4f916aeb46bc237a62150
SHA256

c222170b04d6a3c56cd095bb5990880ed28fd343ef6f341442a670230b4af081
SHA512

863a2fa72d8e5b48d98ca69d7324ee3196c93a6e94d387327dfe00b07deec0ef0e31ab0749afff76e35060c947511fde5b2e660e499798ff61d6be581015a2b9
SSDEEP

24576:lq8yVvb+bonxCKv0ihabY3QAVCaE8onlYM6RBJtCEAmJ7Ar6hDqWBaFp6Emr9rR:fbKKeabY3QAVCa8lYfVAmC3DFp6hr1R

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\Control Panel\International\Geo\Nation	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\L:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\U:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\X:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\E:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\O:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\Q:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\V:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\Y:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\Z:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\W:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\B:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\H:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\K:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\M:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\R:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\S:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\G:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\I:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\J:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\N:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\P:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File opened (read-only)	\??\T:	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\hardcore hidden cock sm .avi.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\sperm catfight mature .mpeg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Common Files\microsoft shared\blowjob licking blondie .rar.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\danish handjob fucking hidden cock .mpg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\sperm [milf] feet .mpeg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Microsoft\Temp\swedish cum lingerie [bangbus] (Sarah).mpg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Microsoft Office\root\Templates\tyrkish cum xxx [milf] pregnant .rar.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\swedish kicking lesbian [free] swallow (Gina,Curtney).zip.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Google\Temp\hardcore hot (!) sm .mpeg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\japanese animal lesbian hot (!) feet upskirt .mpg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\indian cumshot gay catfight cock ejaculation (Tatjana).rar.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Google\Update\Download\italian gang bang blowjob [bangbus] .mpeg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\danish horse bukkake hidden hole .rar.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\bukkake girls feet .rar.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\lingerie several models .rar.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\bukkake sleeping wifey .zip.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\danish nude lesbian girls feet .mpeg.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
4428	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
4428	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
3236	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
3236	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4428	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	92
PID 5088 wrote to memory of 4428	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	92
PID 5088 wrote to memory of 4428	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	92
PID 5088 wrote to memory of 3236	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	93
PID 5088 wrote to memory of 3236	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	93
PID 5088 wrote to memory of 3236	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	93
PID 4428 wrote to memory of 1528	4428	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	95
PID 4428 wrote to memory of 1528	4428	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	95
PID 4428 wrote to memory of 1528	4428	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	95
PID 5088 wrote to memory of 4092	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	96
PID 5088 wrote to memory of 4092	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	96
PID 5088 wrote to memory of 4092	5088	NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe	96

C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        8⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        8⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        8⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:14352
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:18736
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:15928
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:18748
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:19060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:18524
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:18196
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12484
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16220
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:17820
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:16372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:19092
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:19084
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14180
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17580
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12228
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:17092
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:520
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:13212
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:18224
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:1212
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17812
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12616
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6092
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:19208
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:19192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:18212
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16748
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:10316
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:14432
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:1556
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:19184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14968
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:18396
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:17132
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14924
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14764
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:19200
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12836
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:17608
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:15056
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:17796
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16896
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:14584
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:2812
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16596
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:11224
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:14608
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:4092
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14852
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:17788
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:13176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:18204
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16380
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:1716
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12552
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:17264
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:17400
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:10976
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:14960
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:2288
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:964
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        6⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:14564
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16060
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:16460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:14732
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:16924
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:4296
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:11148
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:15036
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:1280
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
        5⤵
        
        PID:18384
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:7980
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:14952
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:15500
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:10564
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:14592
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:2484
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:13336
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:11380
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
      4⤵
      PID:17740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:13220
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:18292
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:10800
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:14944
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:7636
- - C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
    3⤵
    PID:14772
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:10348
- C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.6d61a51a0012377e9fa37ea87f4bcc90_JC.exe"
  2⤵
  PID:14468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\danish handjob fucking hidden cock .mpg.exe

Filesize
1.1MB

MD5
ea1d5d94d852e59945258938beca1a1c

SHA1
981f938c3936a68495f377ae5d66022c12e1585b

SHA256
0c9afeab6a8ae70dc80fe73dcd6dbc86779b2bc594504b6ed46af853cdc132f2

SHA512
1242660beca337dd9961e24742344b38b0583d5d2e0d9284b55328e8e9c1f8ddc7c336c7ba0f2129831e8f34453ace79e9393a2dbd80e1c117016db098c80896

Download Submit
memory/228-237-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/520-179-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/520-150-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/760-169-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/964-172-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/964-203-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1096-170-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1212-210-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1212-185-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-202-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1280-171-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1528-154-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1556-194-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1560-149-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1560-173-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1808-184-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/1808-217-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2288-148-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2388-191-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2484-245-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2608-193-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2608-223-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2780-189-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2780-212-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2932-218-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2932-187-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/2940-192-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3236-32-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3236-151-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3288-164-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3688-152-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3972-190-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/3988-204-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4080-162-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4092-161-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4104-175-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4168-224-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4168-195-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4316-155-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4428-144-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4556-197-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4724-215-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4744-196-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4744-227-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/4828-198-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5076-211-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5076-188-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5088-147-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5088-143-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5088-264-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5088-0-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5160-219-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5192-220-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5260-221-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5296-222-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5432-225-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5500-228-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5576-236-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5596-240-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5644-230-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5652-234-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5664-241-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5800-243-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5856-244-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/5872-242-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download
memory/6116-246-0x0000000000400000-0x000000000041C000-memory.dmp

Filesize
112KB

Download