Overview

overview

7

Static

static

3

103Windows...RE.exe

windows10-2004-x64

7

103Windows...RE.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    05/06/2026, 22:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    103WindowsAgentSetup_DOES_NOT_EXPIRE.exe
  • Size 82.9MB
  • Sample260605-2f2ehaew5t
  • SHA256 3d0d66530df283485eba7bed567401caf31c3844618270069a76950857b206f0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomwarespywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 47 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 26 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 46 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\103WindowsAgentSetup_DOES_NOT_EXPIRE.exe
    "C:\Users\Admin\AppData\Local\Temp\103WindowsAgentSetup_DOES_NOT_EXPIRE.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:5012
    • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WindowsAgentSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\WindowsAgentSetup.exe" /v" CUSTOMERID=103 CUSTOMERNAME=cd50b83bed70e78546a1a0799b37ad9d67309eee67da764f070d77ceb2cfcbc9 CUSTOMERSPECIFIC=1 REGISTRATION_TOKEN=1f62d2e8-79ad-8a70-47b0-9f128b2e1205 SERVERPROTOCOL=https SERVERADDRESS="harborit-west.n-able.com,ncod827.n-able.com" SERVERPORT=443 "
      2⤵
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5060
      • C:\Windows\SysWOW64\MSIEXEC.EXE
        "C:\Windows\system32\MSIEXEC.EXE" /i "C:\Windows\Downloaded Installations\{073895D8-EFA7-4534-A3D8-BD0268342FFA}\Windows Agent.msi" CUSTOMERID=103 CUSTOMERNAME=cd50b83bed70e78546a1a0799b37ad9d67309eee67da764f070d77ceb2cfcbc9 CUSTOMERSPECIFIC=1 REGISTRATION_TOKEN=1f62d2e8-79ad-8a70-47b0-9f128b2e1205 SERVERPROTOCOL=https SERVERADDRESS=harborit-west.n-able.com,ncod827.n-able.com SERVERPORT=443 SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000" SETUPEXENAME="WindowsAgentSetup.exe"
        3⤵
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2820
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding E97C85958C8FCCA1CF86A8C54ABCF185 C
      2⤵
      • Loads dropped DLL
      • Badlisted process makes network request
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3184
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7D573A80-B390-4697-B762-BA86585DB2C2}
        3⤵
        • Executes dropped EXE
        PID:3164
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{173C14D6-E96B-4BCE-890F-C3285DC259E6}
        3⤵
        • Executes dropped EXE
        PID:5760
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB3F31FE-39BC-4C89-90ED-7F5F1EF7951C}
        3⤵
        • Executes dropped EXE
        PID:2844
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{02F9D5D3-7DB7-4D8C-AE77-33F7F69E45DD}
        3⤵
        • Executes dropped EXE
        PID:1176
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91819F0C-9636-4CBB-A662-AC6EB66F6D87}
        3⤵
        • Executes dropped EXE
        PID:1668
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95191E96-82D0-4F79-B1ED-5E6873243B0C}
        3⤵
        • Executes dropped EXE
        PID:1636
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{450A0262-A23A-41D1-9DD3-E0B705F186D9}
        3⤵
        • Executes dropped EXE
        PID:5536
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F1CB01CE-70AB-4707-83C4-E1D6AC3C8E08}
        3⤵
        • Executes dropped EXE
        PID:4016
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7A2CB5DC-5273-4FFD-A1BA-368AF03BE0EE}
        3⤵
        • Executes dropped EXE
        PID:4848
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91932992-5241-4710-A94E-231165653038}
        3⤵
        • Executes dropped EXE
        PID:4488
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{69044DA6-1C58-4E11-9316-AAB1ACA18752}
        3⤵
        • Executes dropped EXE
        PID:3192
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{57771D75-3512-46BD-9A82-07B5C36DCB39}
        3⤵
        • Executes dropped EXE
        PID:1912
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A4BF98AD-BD50-4901-9547-1BE4822361B4}
        3⤵
        • Executes dropped EXE
        PID:5276
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D20CCCBE-53EF-459D-AC1B-32D51FFA0D6F}
        3⤵
        • Executes dropped EXE
        PID:5380
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{615E7300-6866-4314-8518-D675BF2CBC2A}
        3⤵
        • Executes dropped EXE
        PID:3740
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DD76E026-4572-460F-8F60-AA02F132FCEA}
        3⤵
        • Executes dropped EXE
        PID:2340
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E23DE204-0007-4322-8BB9-5EF0989FFDA1}
        3⤵
        • Executes dropped EXE
        PID:2488
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A39301E3-5BED-44FF-B8EE-D04816D8A58A}
        3⤵
        • Executes dropped EXE
        PID:5700
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{95C0CFC8-E626-421D-B3D0-F732B14C071F}
        3⤵
        • Executes dropped EXE
        PID:1456
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3C25E9D7-95FA-4F80-9DB6-53FE420892C2}
        3⤵
        • Executes dropped EXE
        PID:4228
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CB91F4BB-3657-4AEC-8CEB-69EBAB130315}
        3⤵
        • Executes dropped EXE
        PID:2344
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{445C8637-DFC5-403F-BBFB-1D5C237F610F}
        3⤵
        • Executes dropped EXE
        PID:1332
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E3554C6-D5C4-4B79-AB7D-A8311F9BE6EC}
        3⤵
        • Executes dropped EXE
        PID:1872
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6219C86E-C1C1-455B-A5C8-560735C50207}
        3⤵
        • Executes dropped EXE
        PID:2080
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AEB36D22-87D5-4127-9EAC-CDB5C573154C}
        3⤵
        • Executes dropped EXE
        PID:3324
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E0065A59-39FE-494E-A50C-6F71C5F49B17}
        3⤵
        • Executes dropped EXE
        PID:2012
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A5C727A6-32F9-41E1-986E-68E2E5F172A1}
        3⤵
        • Executes dropped EXE
        PID:5656
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5FD8861C-266B-4AFF-AE08-F29774183662}
        3⤵
        • Executes dropped EXE
        PID:1820
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9CD37DEA-2B33-4123-8F1A-0834A385001C}
        3⤵
        • Executes dropped EXE
        PID:4972
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{06D18E95-FA89-4021-B109-1D7E548CA862}
        3⤵
        • Executes dropped EXE
        PID:920
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81BC34EF-1F9B-4D71-BB77-A140D378AA45}
        3⤵
        • Executes dropped EXE
        PID:1132
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{195EA2BA-D333-4CE8-BB95-DA4FB512631D}
        3⤵
        • Executes dropped EXE
        PID:4832
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DF55E9E4-D3EC-425F-AED0-3B083DD046D1}
        3⤵
        • Executes dropped EXE
        PID:980
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{09DE67F1-5631-4B32-9B02-5882FED867A5}
        3⤵
        • Executes dropped EXE
        PID:1592
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A018F7CB-2CE3-4DF6-BBAA-FAFF8E0DD3CC}
        3⤵
        • Executes dropped EXE
        PID:4012
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8222B232-3002-4855-9037-2EA0BC87F5FB}
        3⤵
        • Executes dropped EXE
        PID:5528
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2E9D658-5350-4A8E-884E-6FB3CA17EFDA}
        3⤵
        • Executes dropped EXE
        PID:4072
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F068352D-B3CD-4C6B-B41F-C595A54425B5}
        3⤵
        • Executes dropped EXE
        PID:4564
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{156B55DB-A13B-4E21-A237-11545C2E0B66}
        3⤵
        • Executes dropped EXE
        PID:4108
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BD4A0C81-6955-48D1-81FD-FBEEF23F73C1}
        3⤵
        • Executes dropped EXE
        PID:4568
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{956B078C-69C1-4341-B4DD-263064358E9E}
        3⤵
        • Executes dropped EXE
        PID:3348
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8863A03B-F139-4C5B-B8EA-3B77EA8F5B6F}
        3⤵
        • Executes dropped EXE
        PID:2776
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C5E5902A-9B17-48EA-9180-E3011ACB039A}
        3⤵
        • Executes dropped EXE
        PID:5412
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C9102B47-9F1D-42CF-B9BC-183050126D5C}
        3⤵
        • Executes dropped EXE
        PID:5428
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D1F5064-B597-45C6-B161-3DB9381404A9}
        3⤵
        • Executes dropped EXE
        PID:1392
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DFF6CAFF-0556-402F-814E-E6914A7557CD}
        3⤵
        • Executes dropped EXE
        PID:3292
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A762988D-D5B0-493C-BC5B-5EF8CD3AC9B3}
        3⤵
        • Executes dropped EXE
        PID:4344
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{90B3302F-2EFE-41D7-A369-E0724C494E3C}
        3⤵
        • Executes dropped EXE
        PID:4264
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C36273D4-A91E-4629-B5E1-B16B0994B52A}
        3⤵
        • Executes dropped EXE
        PID:5532
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E9ECC57-5208-4E5D-9AB9-CD09AF8C99EC}
        3⤵
        • Executes dropped EXE
        PID:4348
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE42DCB8-C972-4B19-AB11-86F0A9E6167B}
        3⤵
        • Executes dropped EXE
        PID:3516
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EF32EC5F-518C-4D23-BB89-E2B516CFDE82}
        3⤵
        • Executes dropped EXE
        PID:1388
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2AD78C16-D5D6-43C3-B793-940B2B734D1A}
        3⤵
        • Executes dropped EXE
        PID:5124
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E6ABDFEA-7973-4F10-882E-108D18FE0473}
        3⤵
        • Executes dropped EXE
        PID:1972
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B724A534-F960-4B72-8692-1EE303853654}
        3⤵
        • Executes dropped EXE
        PID:3196
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B092234-AD1A-4A6F-BCB6-D1773E2BD0DC}
        3⤵
        • Executes dropped EXE
        PID:4116
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D42C8822-79BC-4DEC-993F-EA4323E5AD11}
        3⤵
        • Executes dropped EXE
        PID:1932
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9D527BF0-598F-49BB-8F10-89D30999E9B4}
        3⤵
        • Executes dropped EXE
        PID:2236
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{640A9D57-E1C8-4265-BE32-3C9651583158}
        3⤵
        • Executes dropped EXE
        PID:5792
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F078C8F6-C4DF-42D4-A2CC-1B3F4BCBC2C2}
        3⤵
        • Executes dropped EXE
        PID:5900
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{91D4D62B-8404-42FE-9B41-87A0F01EFFF4}
        3⤵
        • Executes dropped EXE
        PID:5240
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0EC93CDF-D845-4175-8595-59943827E2BE}
        3⤵
        • Executes dropped EXE
        PID:5952
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3088848-EE51-4696-B254-AC874154C366}
        3⤵
        • Executes dropped EXE
        PID:2544
      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{073AE977-8001-4710-807B-7B455A294A11}
        3⤵
          PID:2496
        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F068D11B-E07B-4B0B-8122-07C6D0612A39}
          3⤵
            PID:5856
          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{323CD586-AF58-4D64-8F36-5D584BC03DED}
            3⤵
              PID:2872
            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E60BD70E-F206-4CD0-B314-44B71C9E52E2}
              3⤵
                PID:3728
              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{71D43D23-0018-47EB-8D84-22E821E8577F}
                3⤵
                  PID:3332
                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1130D4CF-3783-41B6-8587-24F54C89D6BD}
                  3⤵
                    PID:2636
                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9AD4D50F-5A28-4E3E-BD31-67B7EC4C85BF}
                    3⤵
                      PID:3856
                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D0E47A82-B51F-4287-9FCD-D3AE788EDF98}
                      3⤵
                        PID:2836
                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA1E3509-040C-401C-AF44-53EE4FAFCE9C}
                        3⤵
                          PID:5592
                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7CF5A7CB-1719-481C-A942-78E87A3D8D5E}
                          3⤵
                            PID:3324
                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{39F3A3FD-E093-49E1-B260-8F74398150FF}
                            3⤵
                              PID:5656
                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6917088A-D167-42AD-AA67-7BB1EA050939}
                              3⤵
                                PID:1820
                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{33707058-125B-4850-82D9-57EA0BDFC31A}
                                3⤵
                                  PID:324
                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9F1DFA27-F3D8-4421-9FC4-38F310E67FC1}
                                  3⤵
                                    PID:3968
                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F44A151-E8AB-45C6-A3A6-E9CFB700E949}
                                    3⤵
                                      PID:3824
                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6115827F-3749-4B70-8700-B9C68057AB0F}
                                      3⤵
                                        PID:4812
                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{76DA2115-9259-4155-AD10-E5D82536A66D}
                                        3⤵
                                          PID:4900
                                      • C:\Windows\system32\srtasks.exe
                                        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                        2⤵
                                          PID:2544
                                        • C:\Windows\syswow64\MsiExec.exe
                                          C:\Windows\syswow64\MsiExec.exe -Embedding 4645B4053716DE1E05C17D6940571838
                                          2⤵
                                          • Loads dropped DLL
                                          • Badlisted process makes network request
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:5496
                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CA288F68-0FBC-4A49-BCC0-59826D11C9F1}
                                            3⤵
                                              PID:4536
                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{48FDE24E-FDEB-4BB7-A339-540B4E5B40AB}
                                              3⤵
                                                PID:3856
                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EB4A845B-EC0F-4ED3-95B7-8980FED25FBE}
                                                3⤵
                                                  PID:5204
                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{81F9D03A-F65D-4A3E-A3D9-6FD2846D9A84}
                                                  3⤵
                                                    PID:4228
                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{26E4B9B9-C0B2-4995-A7CF-BD950A3EF02E}
                                                    3⤵
                                                      PID:3768
                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{498A2D88-814E-4D59-A697-E76BC14EA05A}
                                                      3⤵
                                                        PID:5420
                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CC8D05F1-5C50-40AA-A3F6-F0BB4A981377}
                                                        3⤵
                                                          PID:5620
                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C4BDA150-9687-4830-8B79-E7511A188E5D}
                                                          3⤵
                                                            PID:3556
                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EDF4358F-DF10-4129-86E7-079B8325E89A}
                                                            3⤵
                                                              PID:884
                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8899B861-BB9A-4171-ACD7-6D535A750D84}
                                                              3⤵
                                                                PID:1168
                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{712551A4-6087-4952-BB9A-A112A3246B70}
                                                                3⤵
                                                                  PID:3956
                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59A4B22E-F8DC-4EC5-80A8-C02C96927017}
                                                                  3⤵
                                                                    PID:2240
                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{59EF17EE-B543-42EE-A8CD-A779BBB8CA49}
                                                                    3⤵
                                                                      PID:1000
                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{82B98A55-4798-4757-870C-B43A545B04B7}
                                                                      3⤵
                                                                        PID:220
                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1461DFAC-0182-4D3D-8F36-6F36F0D00B96}
                                                                        3⤵
                                                                          PID:2284
                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B6F462BF-192F-462B-92DB-F029998BB36E}
                                                                          3⤵
                                                                            PID:2252
                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1CFFBCD1-A292-4F02-9B1C-0EAB212396AD}
                                                                            3⤵
                                                                              PID:5756
                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8588F2F5-80B2-4D5D-8189-FE463DE5CADF}
                                                                              3⤵
                                                                                PID:3344
                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DA508889-D78D-4FC8-A84E-F8DBDCDA557C}
                                                                                3⤵
                                                                                  PID:3256
                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E8226F2E-2ECB-427B-A032-3915396BA334}
                                                                                  3⤵
                                                                                    PID:5612
                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7CD68AB-32C3-4B61-AE87-20409F354E66}
                                                                                    3⤵
                                                                                      PID:2552
                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B279F6FF-CCA5-4649-9643-727EBA091D55}
                                                                                      3⤵
                                                                                        PID:5328
                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{235C469C-C790-4C28-B041-0A0F916131FA}
                                                                                        3⤵
                                                                                          PID:5156
                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FCBFF272-ED31-4471-80A7-BC9CAF4EF77B}
                                                                                          3⤵
                                                                                            PID:4744
                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{79028B51-7B91-4400-896B-4B5FFE2CADEA}
                                                                                            3⤵
                                                                                              PID:3076
                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EABBFAD3-1067-421A-A186-4E9CA288DB79}
                                                                                              3⤵
                                                                                                PID:4728
                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9A30639F-0572-48B0-B73C-B6A4F00B6EA4}
                                                                                                3⤵
                                                                                                  PID:3348
                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0FDDDCAF-B9C1-46EA-9E4A-561FE6CDA292}
                                                                                                  3⤵
                                                                                                    PID:2776
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6CAFAB80-D4F6-4DC8-902C-EF76CDE6DCFA}
                                                                                                    3⤵
                                                                                                      PID:1300
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8547994B-4E11-4558-B0F1-285ED8656730}
                                                                                                      3⤵
                                                                                                        PID:4472
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8058DA2C-0023-4F52-A037-7181B8A561A4}
                                                                                                        3⤵
                                                                                                          PID:4040
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE5F6CE4-E73E-41F8-955C-22BFF3C06EA7}
                                                                                                          3⤵
                                                                                                            PID:4988
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FF158108-7943-474F-BB80-F4DC0B0ADDA3}
                                                                                                            3⤵
                                                                                                              PID:3732
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DBEC2599-18F5-47F9-AECC-BB11275460DC}
                                                                                                              3⤵
                                                                                                                PID:4676
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4FA30AB9-D91A-40DB-8168-6121FC025971}
                                                                                                                3⤵
                                                                                                                  PID:3116
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{10225DD2-C9F2-48C0-B53D-CA9FFEB9FE19}
                                                                                                                  3⤵
                                                                                                                    PID:3620
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0078D989-2B6F-45E8-9DD3-B143F0D52882}
                                                                                                                    3⤵
                                                                                                                      PID:3612
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6957735F-6F90-4FA8-8778-CDEC65B32FCA}
                                                                                                                      3⤵
                                                                                                                        PID:4924
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D410C085-B99C-4D5C-978C-45CD051EDBD1}
                                                                                                                        3⤵
                                                                                                                          PID:4620
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{15CD8F36-5EB0-4FB2-8205-E1F331EE26F9}
                                                                                                                          3⤵
                                                                                                                            PID:4204
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EFCAB261-D90A-4F4E-AF0A-9A60971A1F9B}
                                                                                                                            3⤵
                                                                                                                              PID:3604
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B3360606-1BD1-4E1E-88D6-ADC863F56CC7}
                                                                                                                              3⤵
                                                                                                                                PID:4764
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B43B8EDE-7049-4696-8542-8CA149EAD182}
                                                                                                                                3⤵
                                                                                                                                  PID:3224
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B71D2084-1CCA-4B05-B2C0-A1C7627FCEFF}
                                                                                                                                  3⤵
                                                                                                                                    PID:5280
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EDDAACCE-5A8E-415A-BB22-E01BCBF42A87}
                                                                                                                                    3⤵
                                                                                                                                      PID:1044
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94C9D523-093B-4C09-A8A9-A973F625019B}
                                                                                                                                      3⤵
                                                                                                                                        PID:2992
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EE9260D1-2BC7-4A6A-9B23-97726A974810}
                                                                                                                                        3⤵
                                                                                                                                          PID:5348
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4677FA88-967F-4E99-B58F-E7D172EF1F0E}
                                                                                                                                          3⤵
                                                                                                                                            PID:2228
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD93DF9A-8118-4B49-A3DC-281760930A32}
                                                                                                                                            3⤵
                                                                                                                                              PID:3740
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5883FE7B-706F-48CE-B423-C4291E10E6BA}
                                                                                                                                              3⤵
                                                                                                                                                PID:3288
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D8E943BF-29C3-4DE5-AEAF-0D282D841122}
                                                                                                                                                3⤵
                                                                                                                                                  PID:2044
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B94D062A-E19A-488A-83D8-BD1433BED138}
                                                                                                                                                  3⤵
                                                                                                                                                    PID:396
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8CDC0CE3-822A-4AA1-9759-746CE8BD1600}
                                                                                                                                                    3⤵
                                                                                                                                                      PID:5440
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{AB15D85F-D514-49AA-AEA1-D0FB58F45154}
                                                                                                                                                      3⤵
                                                                                                                                                        PID:5708
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{094E1A7B-4EB5-4B52-91F1-B7FCD1F585B1}
                                                                                                                                                        3⤵
                                                                                                                                                          PID:5540
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{23C1E743-BF58-4010-8800-D2FAEDD03806}
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2484
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5ED45A10-51CD-45A5-9FBC-2E385C83F105}
                                                                                                                                                            3⤵
                                                                                                                                                              PID:860
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25B020CC-66DF-40C3-941A-ED8FA97D34BA}
                                                                                                                                                              3⤵
                                                                                                                                                                PID:968
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{98CBF12F-05C2-4E1D-9BB3-7AE2A6CC5084}
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:3968
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8755722B-5268-427E-9C96-8E19BD58C697}
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4964
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{32058739-8C55-4802-BDA8-FA7F351BBC91}
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3200
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B0DF9ABA-779E-4ED6-88FC-224AE3D56449}
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:5248
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{773B9C86-6DA0-4207-B797-47BE365476BB}
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:3580
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{465D2211-450F-410C-B876-5B451501D68B}
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:3388
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EFE2CDB4-33DA-483C-AF9E-5CBB218569F1}
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5564
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1570CDB2-0F8C-4B68-8B91-F0EFF0395310}
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:2252
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6B0E6803-63B1-4F13-B424-18E83B0F5728}
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4928
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4BCED638-2EF3-4D3E-8ACD-7C133730B37C}
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:2552
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1214B335-2DCD-4966-910C-27B5E9A321D3}
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:5268
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FDF9650D-9FA7-47C9-9BFD-E364C9669A10}
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:5908
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E3388A25-8782-4CB1-83D8-FE6AC585AA29}
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:3076
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{74F24F1F-CD46-4264-9B3D-E747E5EF5BB5}
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:2704
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9771B4B0-9410-4221-8327-F9782451D015}
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:4052
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CAA01F70-B678-4E40-8273-A5AAAF004EB8}
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:5412
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6A95445A-B96A-4207-BB59-BCB6E1F708B8}
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:440
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3E541E98-D1E7-4343-B133-C50A82C60D8E}
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:972
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A2D22DBC-5A85-4BDE-ACAC-64764230BD3F}
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:4684
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{152792C8-222F-40F8-AEC6-E6C453E3FFC6}
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6F830E4D-F520-4443-9302-6C73ADC2DC54}
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2FA8CCB4-4268-4016-9BF6-FCD5BE287ED5}
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF04EB0C-604A-479F-A231-4F2785637D4A}
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:3752
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{297233F4-0490-40ED-A635-2846F0FD4242}
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:5104
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6F4BE32F-5029-4378-91EB-4848838DFC0D}
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:3884
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C1C7C4FD-B418-46A4-B2BA-E20D5A3D9A52}
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:3928
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B99497C-B4CC-4050-82A9-029A83D63C99}
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1228
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B4F92730-0DE4-4004-AE9E-AED3FCEE7B6E}
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:4572
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{599A278B-EF16-4B38-BF11-906E73C0ED8E}
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:4580
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{450D7897-305B-490A-8D80-69C2CD266699}
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{827ED775-F6C2-4148-80D7-1C25BF9A161B}
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:3180
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{765C5651-E089-4953-914B-0273297174FA}
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1784
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B48FE598-2D5A-4F70-B6EE-56C85443C734}
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:5864
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{DE3AE098-CBE5-4EB3-860A-13CD12461B6E}
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:5320
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{25E0AD69-2B98-4729-ACA4-B2233E9AD005}
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:5792
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A50C2267-0CF8-4149-92CB-0128BEC3A6A2}
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5664
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF75E112-52C5-4156-A509-F34D449D15B0}
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:5112
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E03AE951-C808-4A48-A0C7-B08C8FD9C5CA}
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:3164
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61438B27-6DDB-41B9-86C7-142376DD0580}
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:4268
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A3E20CB-0CE9-4934-B5BE-8C5315D175C0}
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:4488
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{031CC10C-F54D-41EE-8CEE-BE3253216865}
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:4240
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F3469B63-676E-432D-9E7E-9DAE10F773B3}
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4896
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2757CB33-3715-46F0-84C2-6FBF4A3D9D20}
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:3684
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B26C77D5-CD3F-423D-941D-E474C55A26D3}
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0F1A08A2-9E0A-40E1-A889-3572D2D62E30}
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:2532
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1EB44FF0-0957-4379-8BBB-D24FDAEEFA2A}
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:2456
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4950384D-5C20-4781-9092-DDA609BF4BC6}
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3776
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D1841502-1036-4CBD-8210-CECF7EB9E13E}
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9C5E93D8-D3A2-4D3A-8CB6-D362D91DF603}
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:3872
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7B56D0EA-98F3-426E-8963-D3F1C8EB48CE}
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1168
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D638749D-277E-410D-BAA8-80423FF8C434}
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1868
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C0CF26D7-4248-4FBD-AD3B-98322217CC79}
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1188
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4D53DC66-28B9-441D-A4A3-966883FBFF83}
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:5848
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F09D3B55-0061-411E-A96D-81D8BC0222D1}
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:2184
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{98840C42-2EB2-4D20-B9CE-A97AA50A6248}
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                              PID:1532
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3790FFEF-43FD-46D9-A4C8-6BFEA462CFE5}
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:2588
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D176355D-DE20-48C8-BCC6-A160C61CFD24}
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:3136
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{489F0DE8-4BFC-4075-92BB-49E37E47B3EC}
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:5880
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7AE81E58-C4A7-4B44-9821-EAA20ED8F4BF}
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:3284
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{52A5311D-F57F-4E58-8EB7-5D9E7765A780}
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:2860
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B404FF2C-3D06-4CBF-918C-A52E93044728}
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:5948
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F00D8C4A-AD47-4DFE-923C-9E87288EF458}
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\Wbem\winmgmt.exe
                                                                                                                                                                                                                                                                                            "winmgmt" /salvagerepository
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:5688
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61EE0ECB-FA90-4EA5-8855-F2282259D68A}
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{452C3845-29E0-405E-B217-AA830A326174}
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:476
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A7FE0AA8-A5D3-4054-85B3-449EA6557693}
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:5976
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                  C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{61EE6C70-66C6-47C8-877F-2AAE6DE1F17B}
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:2656
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                    C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{2B0B8E60-71F1-43C2-89E2-9E51B742D4CD}
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:4060
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                      C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{107C6183-20F7-444B-B2BF-190FCA1A56FE}
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                        PID:4052
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E7E7347-4266-42DA-83A1-4A58F52CC94B}
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:5412
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6E88A496-274C-4458-B693-0E05AAFC4F99}
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:440
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                            C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8F827F29-5654-493B-8084-D369A7E95286}
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:4684
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                              C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E6AD0659-F836-4434-B62D-E606376EAF8C}
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:5272
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                                                                "sc" failure "Windows Agent Maintenance Service" reset= 86400 actions= restart/1200000/restart/1200000/restart/1800000/
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:4084
                                                                                                                                                                                                                                                                                                            • C:\Windows\Installer\MSI4C39.tmp
                                                                                                                                                                                                                                                                                                              "C:\Windows\Installer\MSI4C39.tmp"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                                                            PID:5572
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\N-able Technologies\AutomationManagerAgent\AutomationManager.AgentService.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                            • Modifies system certificate store
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            PID:4812
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:980
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AgentMaint.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AgentMaint.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AgentMaint.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\AgentMaint.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            PID:4676
                                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\agent.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            PID:5380
                                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\NableSixtyFourBitManager.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\N-able Technologies\Windows Agent\bin\NableSixtyFourBitManager.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:4064
                                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableReactiveManagement.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\N-able Technologies\Reactive\bin\NableReactiveManagement.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                PID:2776
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\lodctr.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\system32\lodctr.exe" "C:\Windows\TEMP\tmp788D.tmp"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:5660
                                                                                                                                                                                                                                                                                                            • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:4672

                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                    e590ae4.rbs
                                                                                                                                                                                                                                                                                                                    • Path C:\Config.Msi\e590ae4.rbs
                                                                                                                                                                                                                                                                                                                    • Size 152KB
                                                                                                                                                                                                                                                                                                                    • SHA256 6070234fcaad8f1db8dccb6f672aad2d6a567083f666ebdfba1f97dc25353e10
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    Settings.xml
                                                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\N-able Technologies\AutomationManagerEngine\2.98.3.1\Settings.xml
                                                                                                                                                                                                                                                                                                                    • Size 22KB
                                                                                                                                                                                                                                                                                                                    • SHA256 58a60c801273fe4736217e1000fe3c4c7e2e0d8192f9b376c420d074dd246d1e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ApplianceConfig.xml
                                                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\N-able Technologies\Windows Agent\config\ApplianceConfig.xml
                                                                                                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                                                                                                    • SHA256 bd4414e419b8c3088f3c0f09adf37219e9fffb940cefb8b36c9d685ab1e91c34
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    RCConfig.xml
                                                                                                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\N-able Technologies\Windows Agent\config\RCConfig.xml
                                                                                                                                                                                                                                                                                                                    • Size 1KB
                                                                                                                                                                                                                                                                                                                    • SHA256 3b205a5a6d5ba7893e1489eb49dca218c56a4eaad3b999321fc9623d30e3f3af
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    AutomationManagerAgentService.log
                                                                                                                                                                                                                                                                                                                    • Path C:\ProgramData\N-Able Technologies\AutomationManager\Logs\AutomationManagerAgentService.log
                                                                                                                                                                                                                                                                                                                    • Size 3KB
                                                                                                                                                                                                                                                                                                                    • SHA256 8038daae5e24860dc639f19cd9ae3c1a6ece0903f1ac8cc38f1a7b405c4b773b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MSI4FA2.tmp
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSI4FA2.tmp
                                                                                                                                                                                                                                                                                                                    • Size 168KB
                                                                                                                                                                                                                                                                                                                    • SHA256 d850c1a06bbf846fdc91ac626de9c37b421daeec61af76ddfa474fd03a7e03cd
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MSI4FF1.tmp
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSI4FF1.tmp
                                                                                                                                                                                                                                                                                                                    • Size 932KB
                                                                                                                                                                                                                                                                                                                    • SHA256 66f8296680d044a8b7fd43ee9d71d67bd36adf4b8842e18925f6ec9dcf22545a
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    MSI537D.tmp
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\MSI537D.tmp
                                                                                                                                                                                                                                                                                                                    • Size 153KB
                                                                                                                                                                                                                                                                                                                    • SHA256 c3a87617d5ba229a62da7fd4e0929be26cac33c58470fd5e5f0b54c30ff4d172
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    NableTrace.log
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\NableTrace.log
                                                                                                                                                                                                                                                                                                                    • Size 646B
                                                                                                                                                                                                                                                                                                                    • SHA256 c2a790d4b055adf28c4ab3b18e71205c6d96b5adf1576ee4d1f5e808f64e7303
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    NableTrace.log
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\NableTrace.log
                                                                                                                                                                                                                                                                                                                    • Size 2KB
                                                                                                                                                                                                                                                                                                                    • SHA256 75d3e481e753a45015c14393cb44169d02021f9a23dd35d9792ed8b60f75765e
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    NableTrace.log
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\NableTrace.log
                                                                                                                                                                                                                                                                                                                    • Size 4KB
                                                                                                                                                                                                                                                                                                                    • SHA256 d3505ec9d5124ab4b2301963804d7fb156cf2d4ee3614406a23375c171f486b1
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    iss3D65.tmp
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\iss3D65.tmp
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 33ff46d96902d5cd2e8b773f5ca3bb3e77f3d9fe3b1d23fd9bb1204def678a7b
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    IsConfig.ini
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{2D681F40-B247-4843-8D75-41D9E4558D8A}\IsConfig.ini
                                                                                                                                                                                                                                                                                                                    • Size 316B
                                                                                                                                                                                                                                                                                                                    • SHA256 da7f4c3e923a8ba0d9d8a617c18b6dcd260ab4b54dc91bc8fb7f464ad3ea8653
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ISBEW64.exe
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISBEW64.exe
                                                                                                                                                                                                                                                                                                                    • Size 177KB
                                                                                                                                                                                                                                                                                                                    • SHA256 1947cabbf8ffcead2a1629c51c028c93f74a5a28cf3e9725dc98231d392b82be
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ISRT.dll
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\ISRT.dll
                                                                                                                                                                                                                                                                                                                    • Size 421KB
                                                                                                                                                                                                                                                                                                                    • SHA256 a35baeced3df5415d2e64dd9855571ace4e5e7168b6e05d235187fc85863d663
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    String1033.txt
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\String1033.txt
                                                                                                                                                                                                                                                                                                                    • Size 180KB
                                                                                                                                                                                                                                                                                                                    • SHA256 4afe36653c4c75db6b0517154e3bb32babc358b9e7b8c22f6a40eef1345bcf57
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    _isres_0x0409.dll
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\_isres_0x0409.dll
                                                                                                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                                                                                                    • SHA256 bdf7ece0a2ae226ecdadf26c05212fa4f6b07e440a9a74cc61785327bf0a23bf
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    setup.inx
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{394B38AA-2057-46E4-B7E9-8489BE019C1C}\setup.inx
                                                                                                                                                                                                                                                                                                                    • Size 290KB
                                                                                                                                                                                                                                                                                                                    • SHA256 dd58f00a5486a253655599074460a7d9edd2cb591e2af8f330799ea89da14dee
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    0x0409.ini
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{B6AF8AB5-5038-40C3-8C33-8AE56B44C04E}\0x0409.ini
                                                                                                                                                                                                                                                                                                                    • Size 21KB
                                                                                                                                                                                                                                                                                                                    • SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    _ISMSIDEL.INI
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{B6AF8AB5-5038-40C3-8C33-8AE56B44C04E}\_ISMSIDEL.INI
                                                                                                                                                                                                                                                                                                                    • Size 272B
                                                                                                                                                                                                                                                                                                                    • SHA256 8ae41f1a3e9cb8d6714aae7a6fee2699a91c279fcffaf3971b633c9c4629c3a3
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    _ISMSIDEL.INI
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{B6AF8AB5-5038-40C3-8C33-8AE56B44C04E}\_ISMSIDEL.INI
                                                                                                                                                                                                                                                                                                                    • Size 46B
                                                                                                                                                                                                                                                                                                                    • SHA256 06d38311dc59cf5a078491d01fe65e579b3c5d72764bf93e35ae24cd74a805be
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    ~39F7.tmp
                                                                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\~39F7.tmp
                                                                                                                                                                                                                                                                                                                    • Size 5KB
                                                                                                                                                                                                                                                                                                                    • SHA256 c6c3f3d1f639e1fcde64ef088e2945fc77b1af8abb30a7fbbe727b62f8d0879c
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    tmp788D.tmp
                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\INF\N-able.Agent\tmp788D.tmp
                                                                                                                                                                                                                                                                                                                    • Size 17KB
                                                                                                                                                                                                                                                                                                                    • SHA256 2e8eef6c6119d2443ac9ecc4afe1af38c474532413b2fb827ec0ff1ff5c67259
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    __PSScriptPolicyTest_iy421bdm.3xf.ps1
                                                                                                                                                                                                                                                                                                                    • Path C:\Windows\Temp\__PSScriptPolicyTest_iy421bdm.3xf.ps1
                                                                                                                                                                                                                                                                                                                    • Size 60B
                                                                                                                                                                                                                                                                                                                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                                                                    memory/980-1253-0x0000000000E00000-0x0000000000E56000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/980-1256-0x0000000009CE0000-0x0000000009D26000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/980-1255-0x0000000009DC0000-0x000000000A024000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-181-0x00000000056A0000-0x00000000057B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-351-0x0000000007260000-0x0000000007371000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-207-0x0000000006EC0000-0x0000000007104000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-208-0x0000000005CF0000-0x0000000005E01000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-210-0x0000000007110000-0x00000000072D7000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-209-0x0000000005CF0000-0x0000000005E01000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-200-0x0000000005C50000-0x0000000005CE2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-122-0x0000000006400000-0x0000000006511000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-245-0x0000000006400000-0x00000000064CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-266-0x00000000078A0000-0x0000000007AE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-267-0x00000000078A0000-0x0000000007AE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-271-0x0000000007100000-0x0000000007211000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-273-0x0000000007AF0000-0x0000000007CB7000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-272-0x0000000007100000-0x0000000007211000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-127-0x00000000065C0000-0x0000000006787000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-319-0x00000000075D0000-0x0000000007814000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-323-0x00000000075D0000-0x0000000007814000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-326-0x0000000005E40000-0x0000000005F51000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-325-0x0000000007820000-0x00000000079E7000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-324-0x0000000005E40000-0x0000000005F51000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-329-0x0000000005680000-0x000000000568A000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-344-0x0000000006540000-0x0000000006784000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-348-0x0000000006540000-0x0000000006784000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-203-0x0000000006EC0000-0x0000000007104000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-350-0x0000000007380000-0x0000000007547000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-349-0x0000000007260000-0x0000000007371000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-358-0x0000000006100000-0x0000000006166000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-146-0x0000000010000000-0x0000000010244000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-157-0x00000000056A0000-0x00000000057B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-160-0x0000000005C50000-0x0000000005E17000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-170-0x0000000010000000-0x0000000010244000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-786-0x0000000006EC0000-0x0000000007104000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-192-0x0000000010000000-0x0000000010244000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-196-0x00000000056A0000-0x00000000057B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-123-0x0000000006400000-0x0000000006511000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-105-0x00000000056A0000-0x00000000058E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-106-0x00000000056A0000-0x00000000058E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-689-0x00000000056A0000-0x00000000058E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-99-0x0000000005C50000-0x00000000061F6000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-98-0x0000000005500000-0x00000000055B4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-699-0x0000000006400000-0x0000000006511000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-97-0x00000000054A0000-0x00000000054AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-878-0x00000000075D0000-0x0000000007814000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-705-0x0000000010000000-0x0000000010244000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-818-0x0000000007100000-0x0000000007211000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-708-0x00000000056A0000-0x00000000057B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-812-0x00000000078A0000-0x0000000007AE4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3184-800-0x0000000005CF0000-0x0000000005E01000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3824-1174-0x0000000000900000-0x0000000000908000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/3824-1175-0x00000000051B0000-0x0000000005200000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4256-1258-0x0000000000BD0000-0x0000000000C00000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1250-0x0000000004E90000-0x0000000004EAE000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1191-0x0000000001720000-0x000000000172C000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1206-0x0000000004880000-0x000000000488C000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1204-0x0000000004870000-0x000000000487A000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1254-0x00000000059F0000-0x0000000005A56000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1252-0x0000000006100000-0x0000000006457000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1251-0x00000000057D0000-0x000000000581A000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1246-0x00000000056E0000-0x0000000005776000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1245-0x0000000006780000-0x0000000006DFA000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1242-0x00000000056A0000-0x00000000056D6000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1240-0x0000000004E30000-0x0000000004E4A000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1230-0x0000000005AD0000-0x00000000060FA000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1213-0x0000000004A20000-0x0000000004A34000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1208-0x0000000004EB0000-0x000000000549E000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1203-0x0000000004860000-0x0000000004870000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1205-0x00000000048A0000-0x00000000048BA000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1207-0x0000000004890000-0x000000000489E000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1257-0x0000000005A90000-0x0000000005AB2000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1193-0x00000000042A0000-0x00000000042BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1192-0x0000000004130000-0x0000000004176000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/4812-1190-0x0000000000B10000-0x0000000000B1C000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-706-0x0000000006180000-0x0000000006347000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-805-0x0000000005980000-0x0000000005A91000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-779-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-701-0x0000000006AC0000-0x0000000006D04000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-839-0x00000000060A0000-0x00000000061B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-780-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-684-0x0000000005850000-0x0000000005A94000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-838-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-825-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-816-0x00000000060A0000-0x00000000061B1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-817-0x0000000007250000-0x0000000007417000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-691-0x0000000005DB0000-0x0000000005EC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-707-0x00000000056C0000-0x00000000057D1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-811-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-690-0x0000000006000000-0x00000000061C7000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-810-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-806-0x0000000005980000-0x0000000005A91000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-700-0x0000000006AC0000-0x0000000006D04000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-799-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-770-0x0000000007210000-0x00000000073D7000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-765-0x0000000006FC0000-0x0000000007204000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-798-0x0000000006750000-0x0000000006994000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-788-0x00000000050E0000-0x0000000005102000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-688-0x0000000005850000-0x0000000005A94000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-769-0x0000000006FC0000-0x0000000007204000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-678-0x00000000050E0000-0x00000000051F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-771-0x0000000006000000-0x0000000006111000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-785-0x0000000005840000-0x0000000005951000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-679-0x00000000055C0000-0x0000000005787000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-677-0x00000000050E0000-0x00000000051F1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-676-0x0000000010000000-0x0000000010244000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-667-0x0000000005DB0000-0x0000000005EC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-666-0x0000000006080000-0x0000000006247000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-665-0x0000000005160000-0x00000000053A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                                                                    memory/5496-661-0x0000000005160000-0x00000000053A4000-memory.dmp
                                                                                                                                                                                                                                                                                                                    Download