f3ba6b26825e1e992a4053f15d4629a71b83e35adb9b9b865ad1213b6d05ce8c

Analysis

max time kernel
8s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
05/11/2023, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.5cb19c52551c16f1368ce8020a486e10.exe
Size

1.2MB
MD5

5cb19c52551c16f1368ce8020a486e10
SHA1

6f0380962db98fceffa120cb429917b352429c0d
SHA256

f3ba6b26825e1e992a4053f15d4629a71b83e35adb9b9b865ad1213b6d05ce8c
SHA512

608d737ad1b99beb251fd18e3e6666b29ed2528c145f19367cae46d42aee09f96edec8646f672c31c155fad924f7011ea66dec6762d1fcaab48b016cc5fa2dff
SSDEEP

24576:7r4gpoQC7QNOkRmnhY8Nb3SXm9+8+UTSMF/BAo5u1tU1oYf8NIV0Kg:/7+s0hqW9T9pF/BA/tU1Rf8NIW

Score

7^/10

persistence spyware stealer upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2231940048-779848787-2990559741-1000\Control Panel\International\Geo\Nation	NEAS.5cb19c52551c16f1368ce8020a486e10.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 38 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/5028-0-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/files/0x0006000000022d6b-5.dat	upx
behavioral2/memory/4816-10-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5032-54-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4636-63-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5028-116-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4836-127-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/516-135-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2324-137-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4816-151-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1452-152-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4348-155-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3016-158-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5032-156-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4636-159-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/772-162-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2248-165-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/516-169-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1472-175-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1000-172-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4836-168-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3316-177-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/2324-176-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4368-178-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4672-179-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1452-181-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4348-182-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/4088-183-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3244-180-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3016-184-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1764-190-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1572-189-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/1748-188-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/5112-199-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/456-235-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3904-280-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3732-313-0x0000000000400000-0x000000000041F000-memory.dmp	upx
behavioral2/memory/3700-346-0x0000000000400000-0x000000000041F000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	NEAS.5cb19c52551c16f1368ce8020a486e10.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\H:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\P:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\V:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\W:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\A:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\J:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\M:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\O:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\Q:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\S:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\Z:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\X:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\Y:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\G:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\I:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\K:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\N:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\R:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\U:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\B:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\L:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File opened (read-only)	\??\T:	NEAS.5cb19c52551c16f1368ce8020a486e10.exe

Drops file in Program Files directory 17 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\fetish sperm lesbian .mpg.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\tyrkish fucking voyeur (Sonja).mpeg.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\chinese fucking sleeping redhair .zip.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\canadian hardcore lingerie hot (!) wifey .rar.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\french lesbian [bangbus] titts latex .rar.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Google\Update\Download\fetish bukkake sleeping redhair (Samantha,Liz).avi.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Common Files\microsoft shared\russian blowjob fucking [bangbus] fishy (Jade,Karin).avi.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\swedish hardcore beastiality masturbation ash .avi.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\indian fucking kicking girls shoes (Sonja,Sonja).mpg.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Microsoft\Temp\american lingerie porn full movie .zip.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Microsoft Office\root\Templates\spanish cum beastiality catfight cock girly .mpg.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\german sperm trambling hot (!) (Jade).zip.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\lingerie full movie 50+ .mpeg.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\african porn big granny (Anniston,Kathrin).mpeg.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\IDTemplates\trambling hidden .zip.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Google\Temp\fetish gang bang masturbation ash 40+ .rar.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\gay voyeur hole black hairunshaved (Sarah).rar.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	NEAS.5cb19c52551c16f1368ce8020a486e10.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
4816	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
4816	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe
5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5028 wrote to memory of 4816	5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe	86
PID 5028 wrote to memory of 4816	5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe	86
PID 5028 wrote to memory of 4816	5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe	86
PID 5028 wrote to memory of 5032	5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe	92
PID 5028 wrote to memory of 5032	5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe	92
PID 5028 wrote to memory of 5032	5028	NEAS.5cb19c52551c16f1368ce8020a486e10.exe	92

C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:3316
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        7⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        7⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9872
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10276
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:772
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:3700
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:12700
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5144
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:3348
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10892
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10824
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:7740
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:9880
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:516
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:792
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10756
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:12544
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10312
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6140
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:11524
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6248
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8812
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10140
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:536
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10776
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:8652
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:11280
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:4836
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10764
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:2044
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:3772
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:11468
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9904
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:12584
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:9076
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:11540
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:1452
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
        
        "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
        5⤵
        
        PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9788
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:212
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:10284
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:7636
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:9540
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:1340
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:4672
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:11648
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
      "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
      4⤵
      PID:9744
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:7352
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:8368
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:8612
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:3800
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:11592
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:5944
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:10056
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:7048
- - C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
    "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
    3⤵
    PID:12356
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:8500
- C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe
  "C:\Users\Admin\AppData\Local\Temp\NEAS.5cb19c52551c16f1368ce8020a486e10.exe"
  2⤵
  PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\chinese fucking sleeping redhair .zip.exe

Filesize
644KB

MD5
5040cb076da01c4a822a84bb52db51bd

SHA1
a31c67a61bc8b12bd805de0ee453fac904dd4aed

SHA256
8def033b1652c0d9ad0e491864648f30b58eb897066d636f5fbbd2249e1b5396

SHA512
bd7e44443a320fc88785295cf383cb12d7a78a3e26028aee1dc0a7459278940150b2627192a17b1918d343db9db471b2a34f643d90829d5cbb277dae0c7a6b17

Download Submit
memory/456-235-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/516-169-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/516-135-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/772-162-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1000-172-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1452-181-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1452-152-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1472-175-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1572-189-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1748-188-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/1764-190-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2248-165-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2324-176-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/2324-137-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3016-184-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3016-158-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3244-180-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3316-177-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3700-346-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3732-313-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/3904-280-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4088-183-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4348-182-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4348-155-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4368-178-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4636-63-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4636-159-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4672-179-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4816-151-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4816-10-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4836-127-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/4836-168-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5028-116-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5028-0-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5032-156-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5032-54-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download
memory/5112-199-0x0000000000400000-0x000000000041F000-memory.dmp

Filesize
124KB

Download