bdec4ac79297f59965a2495ce18f468d72cebb1cb2dd63260239d28a6492d7ac

Analysis

max time kernel
4s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 09:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
Size

326KB
MD5

26ebf1f71b4b34006787cbb7a23a3fd0
SHA1

46ab6592d0e32761e7cce12b94a64eef2f8151fb
SHA256

bdec4ac79297f59965a2495ce18f468d72cebb1cb2dd63260239d28a6492d7ac
SHA512

f53487443e5c09a95430e6600372f52d2b2448973e628cf07ee9c57ba3ee2703d934e8f7a4239151c1dca6e6321b736ea1a0ce353d42cfd6a10c87ce25955930
SSDEEP

6144:oGHGRpO9p1om9+xs3NBBpIaKFpWCouQl8AZMnzv2/j8Kl//i4/czUZEaMX1cCFhD:oGHasii9BTukCgZMnT2/jvl//HcZa41f

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\I:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\S:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\U:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\Z:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\K:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\N:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\O:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\R:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\V:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\W:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\A:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\G:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\J:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\L:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\P:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\Q:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\X:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\Y:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\B:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\E:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\M:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File opened (read-only)	\??\T:	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office\Updates\Download\canadian lingerie fucking full movie .rar.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\Common Files\microsoft shared\horse [bangbus] shoes .mpg.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\dotnet\shared\horse fetish catfight .avi.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\Templates\african fucking public circumcision .avi.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fetish full movie gorgeoushorny .mpeg.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\fetish lesbian uncut cock .avi.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\african nude [bangbus] .zip.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\african cum porn hidden (Curtney,Samantha).zip.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3812	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
3812	26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe

C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
"C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:3812
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:1956
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:3960
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:3204
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6204
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10804
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:12640
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:13300
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:10872
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2344
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:11036
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:11968
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:11260
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:9628
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:7464
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:8768
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:11868
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        7⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7480
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10652
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:11732
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:12648
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2212
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:11456
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:12068
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:7472
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:8780
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:11692
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:5584
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        6⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2040
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10516
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:10836
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:11272
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:5748
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:10548
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:7152
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:8728
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:4952
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:4608
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2624
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
        
        "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
        5⤵
        
        PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:2260
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:11252
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:10624
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:6768
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:1488
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:8652
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:5996
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:5536
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:10540
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
      "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
      4⤵
      PID:6328
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:9252
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:6124
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:5000
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:8368
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:11220
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:528
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:10416
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:6964
- - C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
    "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
    3⤵
    PID:10028
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:8620
- C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe
  "C:\Users\Admin\AppData\Local\Temp\26ebf1f71b4b34006787cbb7a23a3fd0_NEAS.exe"
  2⤵
  PID:11228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8
1⤵
PID:9308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\fetish full movie gorgeoushorny .mpeg.exe

Filesize
535KB

MD5
7a929f1b91f7e8ee93ddfb0d087e788e

SHA1
d8b702d6797f2c1ca8b02a3d1aefb8111a43016c

SHA256
a34752bad431660cc0d81b4bc82a30981374efc954f463064bd18f06467121c0

SHA512
1ad5727c8f2e9ea0779f21584612fec8d0dd18c8e02b57e9f642c2e7eca915ed7bf5be429e77f94d4718ecfcce0ebfa8f0e42ae8c164c158d61c8dd42d26dca9

Download Submit